Is it reasonably safe to uncheck autoblock source of packets not handled?

Trying to troubleshoot some performance issues with a certain website that we subscribe to, I installed pingplotter at the suggestion of the vendor. Pinging/trace routing the site caused it to be blocked by our Firebox, due to the "autoblock source of packets not handled" option. Watchguard suggested that we uncheck  autoblock source of packets not handled and that it would be ok to do so.

What are the thoughts out there about this? I'm guessing it is probably OK to do so while I'm testing, but what about leaving it that way? Am I inadvertently blocking other legitimate sites? (I know, I should check the logs to answer that question).

There isn't really a solution to the Q - but I'd like to have some info to make an informed decision.

thanks for any input.
youngslimAsked:
Who is Participating?
 
dpk_walConnect With a Mentor Commented:
No problems in leaving that option disabled always; in the latest version of software and even in 9.x the option is disabled by default.

Let's first understand what this option implies; let's say you are not hosting any servers and by default all incoming traffic coming on the external interface of the firebox from the internet would be denied; if the option is enabled; in addition to denying the packets (default behavior no configuration needed for this) the firewall in addition block the source of packets and put them under blocked sites [System Manager->Blocked site tab]. If the option is disabled the firewall continues to deny the packet; just does not put the source of IP under blocked site.

What you loose; if you are a target of some port scan and the IP is under blocked list, then the firewall would not attempt to see if the rules permit/deny the requested port/protocol; thus saving CPU cycle.

Hope this help; please let know if you need more details.

Thank you.
0
 
youngslimAuthor Commented:
That was a good, informative answer. Thanks,

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.