WatchGuard Firebox System 4.6 User Guide

CHAPTER 7Blocking Sites and PortsMany types of network security attacks are easily identified by patterns found inpacket headers. Port space probes, address space probes, and spoofing attacks allexhibit characteristic behavior that a good firewall can recognize and protect against.WatchGuard allows both manual and dynamic blocking of ports and sites, and usesdefault packet-handling options to automatically and temporarily block hosts thatoriginate probes and attacks. Logging options can assist you in identifying suspectsites that repeatedly exhibit suspicious behavior. You can then manually andpermanently block a suspect site. In addition, you can protect ports with knownvulnerabilities by blocking their unauthorized use.Configuring default packet handlingThe WatchGuard Firebox System examines and handles packets according to defaultpacket-handling options that you set. The firewall examines the source of the packetand its intended destination by IP address and port number. It also watches forpatterns in successive packets that indicate unauthorized attempts to access thenetwork.The default packet-handling configuration determines whether and how the firewallhandles incoming communications that appear to be attacks on a network. Packethandling can:• Reject potentially threatening packets• Automatically block all communication from a source site• Add an event to the log• Send notification of potential security threatsFrom Policy Manager in the Advanced view:1 Select Setup => Default Packet Handling.User Guide 43