Priority of Local In Policy and IPv4 DoS Policy
Hello
Which rules: "Local In Policy" or "IPv4 DoS Policy" have higher priority in filtering traffic and should be activated first?
It makes sense to me that the "Local In Policy" rules should work first. If some network traffic is detected and stopped in "Local In Policy", it should not reach the "IPv4 DoS Policy" module anymore...
However, that's probably not the case...
I have a rule in "Local In Policy" that blocks network traffic by geolocation (Russia, China, etc). In "IPv4 DoS Policy" I tested only one rule with very small values (e.g. 1, 5) of anomaly thresholds and a "Monitor" action (does not block) to see if any network traffic comes here.
In Fortianalyzer, however, I observe that the rule in "IPv4 DoS Policy" captures network traffic that should not be allowed by the "Local In Policy" module, i.e. network traffic from countries such as Russia, China, etc.
I gave here an example of blocking after geolocation, but the same behavior is also in the case of attempts to block specific IP addresses.
Have I configured something incorrectly?
