Implied Rules vs manually created policy rules

[Mike_Jensen]

Hello,

I am confused with the below scenario.

I am able to ping mailserver.mycompany.com from the public internet and I need to drop this traffic.  Logs show this traffic is accepted via implied rule.

In global properties I have Accept ICMP requests checked and it is set to Before Last.  I think this is what allows the pings with a implied rule?

If I create a test rule near the top of my policy with the source being my public internet ip, destination ip address for mailserver.mycompany.com, action drop the pings are dropped by that rule as expected.

My policy has a cleanup rule at the bottom.  I don't understand why the icmp request / ping traffic is not dropped by the cleanup rule but is dropped by my test rule?

With the global property set at "Before last" does that literally mean that the implied rule is applied before the last rule (my cleanup rule) in the policy?

What is the best practice when it comes to dropping unwanted traffic like this?

[_Val_ · Accepted solution]

I think you just answered all your questions yourself. Yes, implied rule "before last" literally means, before the last explicit rule, which is usually the cleanup policy rule. ICMP "Before Last" is disabled by default. In your case, you can just un-check it and install policy. If you need ICMP to run, I would recommend more targeted explicit rules for that.