Firewall Deny Vs Drop

[Ven]

Hi Experts,

Firewall deny vs Firewall Drop.  Out of two which consumes cpu resources or affects GW performance when looked at during an DoS scenario ?  

[Marcel_Gramalla]

You mean "Block" vs "Drop" right? As block sends a connection refused it consumes more CPU and you can actually detect if there is something on that IP. Drop on the other hand just ends in a timeout.

[Ven]

yes, question is about Block" vs "Drop.  Thanks for your quick response and info

[_Val_]

Neither Deny nor Block are used in FW Network Security rules. You probably mean "Reject", right?