Received unknown DDOS traffic from outside and firewall accepted it

hilalwani — Tue, 05 Mar 2024 12:29:03 GMT

Guys,

This morning I've received some unknown outside traffic from this IP 172.81.61.147 to inside and the firewall accepted it by implied access rule with rule number 0. having a source port 39640 and a service FW1_ica_services (TCP/18264).

The outside-to-inside policy is already in place which is denying the external unknown traffic, but I wonder how it was accepted by the firewall.

Can anyone clarify it and help to avoid such unknown DDOS traffic coming from outside

Re: Received unknown DDOS traffic from outside and firewall accepted it

Lesley — Tue, 05 Mar 2024 16:33:21 GMT

https://support.checkpoint.com/results/sk/sk99076

https://support.checkpoint.com/results/sk/sk52421

https://support.checkpoint.com/results/sk/sk32682

Would not recommend to close this port 18264

Since DDOS can happen on any port not only 18264 here is something interesting for you regarding DDOS topic:

https://support.checkpoint.com/results/sk/sk112241

topic Received unknown DDOS traffic from outside and firewall accepted it in Firewall and Security Management

Received unknown DDOS traffic from outside and firewall accepted it

Re: Received unknown DDOS traffic from outside and firewall accepted it