Traffic prevented on Anti-Bot but accepted on firewall

[marcinw]

Hi 

I am wondering if this is something that I should be worry about ? I assume that it should be alright that traffic is accepted on implied rule and next is stopped by Anti-bot 

[AmirArama]

the traffic is accepted by the Firewall blade access (implied rules) but dropped by AB. 

you can double check it with tcpdump/fw monitor/fw ctl zdebug + drop | grep x.x.x.x

[Lesley]

Looks normal behavior. Sometimes the firewall needs to allow a bit of traffic in order to further check it. It can happen that firewall decides to block it in a later stadium. 

Also some policy’s are separate. For example firewall policy and app / url filtering can be separate. So traffic first passes firewall rule base and it is allowed. But then I check the application filtering rulebase and then it could be blocked. 

[the_rock]

As Amir had said, I would also do zdebug to confirm.

Best,

Andy