Default Drop is not logging

Question

Hello Community, 
 we have on a firewall (XG210 HA, v18-MR1) the problem that not all dropped connections are listed in the log. This concerns on the one hand ICMP packets and on the other hand (partly) other packets which are not logged by the default drop. We have activated ICMP logging as described here: https://support.sophos.com/support/s/article/KB-000037153?language=en_US 
 In the default drop all rejected connections should be logged without the need to configure this explicitly. 
 How can I solve the problem? 
 
 Thanks, 
 Ben

LHerzog · Answer

Hi, 
 the default block rule has no logging. We created a custom block rule before it where we enabled logging. 
 We had this problem a few times in the past when we created new zones on the firewall and forgot to put them in the source list of the custom block and log rule. Btw. one could just select any as source zone.

Ryan Partington · Answer

doesn't the newer firmware come with a default block rule now with logging - anybody? maybe it's v18+?

Default Drop is not logging

Top Replies