My UTM has been undergoing a port scan for several hours. The scan has the FIN and ACK flags set. From what I can see, the UTM is reporting that the packets are dropped by default. However, in a wireshark trace, I see the UTM sending RST flag packets to the source IP address. I thought the UTM was supposed to drop the packets by default. Setting a rule to drop that IP address has no effect as the UTM still replies to the scanning IP address with a RST packet.
Is this a normal response from a firewall to this type of scan?
This thread was automatically locked due to age.
