Simple explanation enabling the LOGGING of blocked implicit traffic that actually works?
Hello,
I apologize in advance for the newbie inquiry; however the answer to this question seems to lack any definitive/updated explanation; I have checked search engine sources, this forum etc; and all the explanations don't actually answer the question in a way that produces a result, i.e, allowing one to simply log denied WAN traffic that is attempting to interact with the firewall
I get that logging denied traffic via the implicit deny rule is disabled by default; and this makes sense as if enabled it could generate massive logs that many would consider to be irrelevant. So all I want to do it is enable it and see what is going on.
So I have set the Implicit Deny baseline policy and enabled "Log IPV4 Violation Traffic"; however, this wouldn't seem to be the answer I am looking for because by default there should be no "violation traffic" coming through the firewall if it is all blocked by this rule. Whether Log IPV4 Violation Traffic its disabled or enabled, no traffic is shown as logged.
I attempted to use the see L I and input some command line suggested in this forum supposedly to solve this problem under this forum heading "This article describes how to troubleshoot missing implicit deny logs."
^^ This completely fails as well
I have also attempted to create a separate rule that mirrors the implicit deny rule and put it at the bottom of the FW rule stack and enable logging; but this also fails to log denied incoming WAN traffic.
Despite all of these steps which I believed I have correctly followed; implicit deny rule shows 0 bytes logged and no where in the logs (that I can locate at least) shows incoming traffic that was rejected by the firewall.
So, is there actually a coherent answer to this simple question that actually works? My two previous firewalls (not forty based); you could enable this by clicking a single option; then when you checked logs, you actually could see the immediate results. It doesn't really make sense that such a seemingly simple process should be so hard to instantiate; either I have completely missed something or this answer/information is being suppressed for some strange reason.
Thanks in advance for any assistance/advice