topic ip_block script lets pass traffic during update / url fetch? in Firewall and Security Management

ip_block script lets pass traffic during update / url fetch?

mp2012 — Fri, 09 Sep 2022 04:10:29 GMT

Hi,

running on R81.10 and still using the ip_block script (as in sk103154), I figured out it let traffic pass on any update. On update every 20mins, then I see packets slip through for a few seconds (logged as accepted). Anyone can confirm this?

If switching to dynamic object based ip block feature and populate it with the same data from url feed - would it change this behaviour?

kind regards,

mp2012

Re: ip_block skript lets pass traffic during update / url fetch?

PhoneBoy — Thu, 08 Sep 2022 18:37:16 GMT

If I'm reading the script correctly, each time the feed is retrieved, it removes the existing SAM rules then re-creates them based on what was retrieved.
That would explain the behavior you are seeing.

Meanwhile, I believe using either a Generic Data Center object (R81+) or a Network Feed object (R81.20+) would not have the same impact.
Dynamic Objects, with appropriate scripting, might also work.