Order of processing Question (USG flex 500)
Options
Hi,
From a course way back with the zywall 50 i thinking that Firewall happens first then the NAT.
Ie if your port translating 444 to 443 you firewall 444 because firewall processes first then nat.
Is this true and where does IDP come in ?
reason i ask :
I have a geo block on all Russian IP addresses, but when i look in IPS logs i see
"SSI:N [type:Sig(130014)] Remote Desktop Protocol brute force attempt"
from a Russian IP address.
I was not expecting to see this as i have a geo block on russia quite high up.
so does IPS happen before my geographic deny rule?
0
All Replies
-
Take a look on Maintenance -> Packet Flow Explore.Maybe the pictures in routing status and SNAT status could be what you're looking for.0
-
HI thankyou yes i see this but it does not mention IPS in the chain?
0 -
Hi @Emerald,
Please help to check if the IP is exactly from Russia in GeoIP database.
You can look up at "Object > Address/Geo IP > GeoIP".
0
Categories
- All Categories
- 384 Beta Program
- 2.1K Nebula
- 116 Nebula Ideas
- 79 Nebula Status and Incidents
- 5.1K Security
- 70 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 70 Switch Ideas
- 907 WirelessLAN
- 34 WLAN Ideas
- 5.9K Consumer Product
- 210 Service & License
- 332 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.9K FAQ
- 885 Nebula FAQ
- 415 Security FAQ
- 226 Switch FAQ
- 198 WirelessLAN FAQ
- 46 Consumer Product FAQ
- 137 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 73 About Community
- 63 Security Highlight