topic Re: Blocking IP addresses using fwaccel dos deny in bridge mode does not work in Firewall and Security Management

Blocking IP addresses using fwaccel dos deny in bridge mode does not work

Blason_R — Sat, 01 Jan 2022 03:23:07 GMT

Hi Team,

I have deployed R81.10 in bridge mode and wanted to block certain IP addresses at sxl level using fwaccel dos deny. I guess it does not work in bridge mode?

It perfectly works in other way not sure if I am doing anything wrong or is this a limitation with bridge mode?

Re: Blocking IP addresses using fwaccel dos deny in bridge mode does not work

Chris_Atkinson — Sat, 01 Jan 2022 05:13:22 GMT

Just to confirm, how is the topology defined, is the src behind an external interface or have you otherwise enabled internal-to-interal checking for fwaccel dos?

Re: Blocking IP addresses using fwaccel dos deny in bridge mode does not work

Blason_R — Sat, 01 Jan 2022 06:58:06 GMT

Hi,

Being a bridge interface it does not give a option to define topology

Re: Blocking IP addresses using fwaccel dos deny in bridge mode does not work

Chris_Atkinson — Sat, 01 Jan 2022 07:33:51 GMT

Re: Blocking IP addresses using fwaccel dos deny in bridge mode does not work

fabianm — Fri, 31 May 2024 06:06:19 GMT

Hi team

I tested the dos deny feature in Fws in bridge mode and it works properly but I must enabled this:

To enable enforcement for traffic received on internal interfaces:

[Expert@HostName:0]# fwaccel dos config set --enable-internal