User guide

Migration Guide 41
Making a Fireware Configuration
Intrusion Prevention/Default Packet Handling
Many of the same options are available in WFS Policy Manager. Nearly all the options are the
same. However, by default, logging of broadcast traffic is turned on by default. To turn this off,
add a policy that matches the traffic with logging disabled.
In the Logging dialog, the logging for Incoming/Outgoing packets not handled is managed by
the Logging dialog from the Default policy.
Auto-block source of packets not handled is managed by added a new deny policy with the
Auto block sites that attempt to connect checkbox selected. Be very careful to explicitly limit
the From and To to a set of addresses that do not include valid traffic.
Fireware uses a new algorithm to block SYN flood attacks that is based upon threshold limits
instead of validation.
Blocked Sites
Fireware's blocked sites support has changed so that this list can apply it to all interfaces. Be very
careful to not add entries here that may also include any real networks accessible from the
Firebox such as trusted, optional, external or other routed networks. If it is necessary to include