Broadcast & Noisy traffic rules

[CiscoGuy]

Hi Peeps



im trying to define a noisy traffic + broadcast rule within CP 4800 , just to keep the logs little bit manageable. Question is what sort of objects required ? , services i need to specify ? drop or reject


Thanks

CiscoGuy

[sdawkiins]

Hello CiscoGuy!

I am no expert and do not claim this to be best practice but what I have configured on our firewalls is as follows (these rules are located just above the cleanup).

Source:any Destination:any Service: ICMP-Requests Action: (Depending on your company policy) Drop/Accept dont log (can enable logging for troubleshooting)
Source:any Destination:any Service: NBT(predefined) Action: drop, dont log
Source:any Destination:any Service: Netvault (Backup software that is noisy if you use it) Action: Drop (Ensure you have specific rules above if you use it, otherwise backups will fail), dont log

Just a few examples from a few of our firewalls.

Also, if you do not care what traffic is dropped, and are able to enable the logging for troubleshooting you can just not log on your cleanup.

Even without enabling the logging on the cleanup, providing you are not running SecureXL at the time you can use the following command to see what is being dropped in real time: fw ctl zdebug drop

Hope this helps.

Sam