Blackhole route for IP, still having portscan alerts

Question

Hi, 
 
 i get more and more frequent portscan alerts running for multiple hours. 
 I would like to block them manually on an IP basis. 
 I created a network group populated with bad IP addresses and implemented this as a blackhole route, but still having the portscan alerts. 
 
 Am i missing something ?

sachingurung · Answer

Hi Greet, 
 Priority of Intrusion Prevention module comes before DNAT i.e., pre-routing IP table. Hence, the packet arriving on the UTM interface will be checked via Intrusion Prevention and alert will be generated before the traffic is mapped towards the blackhole. That is because of the architectural behavior. Here we are not actually dropping(blackhole) the traffic instead, we are mapping the traffic towards a non-existing IP address. 
 Hope that helps.

Blackhole route for IP, still having portscan alerts

Submitted a Tech Support Case lately from the Support Portal?