Blocking IP addresses using fwaccel dos deny in bridge mode does not work

[Blason_R]

Hi Team,

I have deployed R81.10 in bridge mode and wanted to block certain IP addresses at sxl level using fwaccel dos deny. I guess it does not work in bridge mode?

It perfectly works in other way not sure if I am doing anything wrong or is this a limitation with bridge mode?

[Chris_Atkinson]

Just to confirm, how is the topology defined, is the src behind an external interface or have you otherwise enabled internal-to-interal checking for fwaccel dos?

[Blason_R]

Hi,

Being a bridge interface it does not give a option to define topology

[Chris_Atkinson]

[fabianm · Accepted solution]

Hi team 

I tested the dos deny feature in Fws in bridge mode and it works properly but I must enabled this:

• To enable enforcement for traffic received on internal interfaces:

  [Expert@HostName:0]# fwaccel dos config set --enable-internal