topic Re: implied rules getting hit and dropping traffic in Firewall and Security Management

implied rules getting hit and dropping traffic

Roy_Smith — Tue, 14 Feb 2023 16:54:13 GMT

Started migrating vlans from an internal Cisco ASA to a new VSX cluster. I am now getting some intermittent reports of applications or servers not connecting as expected. When I look through the logs, I see lots of drops related to an implied rule. This is hit by different sources and destinations and different ports.

After following sk110218, I am able to see the implied rule name, which is "Implied Rule - enforce_net_quota". The name of this rul seems to indicate I'm hitting some sort of limit but not sure what.

Can anyone tell me what enforce_net_quota refers to please?

Many Thanks
Roy

Re: implied rules getting hit and dropping traffic

Danny — Wed, 15 Feb 2023 06:47:40 GMT

Try turning off Network Quota and verify if this helps.

Re: implied rules getting hit and dropping traffic

the_rock — Tue, 14 Feb 2023 18:45:59 GMT

Can you send screencap of it if possible? I checked sk you mentioned, but does not sadly seem too useful here. I also saw what @Danny suggested, but cant find that protection even in my R81.20 lab with updated IPS.

Searching CP support site, cant find much on it, so might be worth if you do zdebug to verify if you get exact same messages. We might be able to figure out from those drops if there is indeed actual IPS protection causing an issue.

Andy

Re: implied rules getting hit and dropping traffic

PhoneBoy — Tue, 14 Feb 2023 22:01:26 GMT

This is definitely the Network Quota protection, which is inactive by default.
You can do one of two things:

Disable it by going to Security Policies > Inspection Settings and setting it to Inactive for the relevant profile
Create an exception for the relevant traffic in the protection

Changing this setting requires pushing the Access Policy (not Threat Prevention) since this is a Core Protection handled by the firewall (not IPS).

Re: implied rules getting hit and dropping traffic

the_rock — Wed, 15 Feb 2023 01:37:09 GMT

Ah, inspection setting, thats why I could not find it...duh, silly me. Anyway, let us know @Roy_Smith if what phoneboy suggested works.

Re: implied rules getting hit and dropping traffic

Roy_Smith — Thu, 16 Feb 2023 04:51:21 GMT

Guys

It was the Network Quota in Inspections Settings that was being referred to. I set it back to inactive and that solved the issue.

Thanks for the help

Re: implied rules getting hit and dropping traffic

PointOfChecking — Mon, 29 Sep 2025 10:23:04 GMT

Hi PhoneBoy,

Any reason why the default for this setting is disabled? I've found it as enabled in my environment and was thinking it could be useful to fend off DoS attacks?

Thank you

Re: implied rules getting hit and dropping traffic

PhoneBoy — Tue, 30 Sep 2025 00:17:28 GMT

Network Quota has a performance impact of Critical, which is why it is disabled by default.
If you're looking to mitigate DoS attacks, you're far better off using fwaccel dos, which is SecureXL friendly.
See: https://support.checkpoint.com/results/sk/sk112454

Re: implied rules getting hit and dropping traffic

PointOfChecking — Mon, 06 Oct 2025 15:06:23 GMT

Will look into this. Thank you.