Core Inspection triggers before Access Rules?

[bcleve1982]

Hello all.  I use email alerts for the "Small PMTU" protection so it emails me whenever one is triggered, so I can then add them to a blocklist.  I created a group object that contains all of the blocked IPs and I use that throughout my rulebase. The problem is, I keep getting emails even from those I have already blocked.  I do not want this, so I created an Access Rule #1 that blocks all traffic from the Rejected_Hosts object.  I still receive email alerts from IPs I have already blocked.  Logs are showing that it is triggering by the Small PMTU protection and not the Access Rule #1.

I did some searching and found out that, somewhat recently, core inspections were now part of the Access Rules.  I'm assuming these are somewhere in the implied rules?  My end goal is to have only new offenders trigger the alert and not currently blocked users.  Any ideas?

[PhoneBoy · Accepted solution]

Actually, the fact Core Protections are done in the firewall is not new.
They've always been done prior to access Access Rules (firewall rules in R77.30 and earlier). 

As to your specific question, I don't believe there is a function to log/alert only on new IPs. 

[bcleve1982]

Thank you for the response.  Is there a way, via exceptions, that I could exclude the "Rejected_hosts" group from triggering email alerts?  Couldn't I have, under the default profile, email alerts for Small PMTU but create an exception for the Rejected_hosts group?  Wouldn't that prevent the group from triggering the alert altogether but they should be rejected by the access rule at that point?

[PhoneBoy]

Exceptions can only be used to exclude certain hosts from enforcement, not from the logging of said enforcement. 
Assuming Rejected_Hosts has the hosts you want to block anyway, that seems like a logical approach to solve the issue.