topic Firewall Deny Vs Drop in Firewall and Security Management

Firewall Deny Vs Drop

Ven — Mon, 26 Jul 2021 10:30:19 GMT

Hi Experts,

Firewall deny vs Firewall Drop. Out of two which consumes cpu resources or affects GW performance when looked at during an DoS scenario ?

Re: Firewall Deny Vs Drop

Marcel_Gramalla — Mon, 26 Jul 2021 10:32:24 GMT

You mean "Block" vs "Drop" right? As block sends a connection refused it consumes more CPU and you can actually detect if there is something on that IP. Drop on the other hand just ends in a timeout.

Re: Firewall Deny Vs Drop

Ven — Mon, 26 Jul 2021 10:34:57 GMT

yes, question is about Block" vs "Drop. Thanks for your quick response and info

Re: Firewall Deny Vs Drop

_Val_ — Tue, 27 Jul 2021 08:08:38 GMT

Neither Deny nor Block are used in FW Network Security rules. You probably mean "Reject", right?