FTD access rule blocks other protocols that are not defined

[komiks]

Hi,

In FTD v7.6.2 I have and access rule to block incoming traffic with destination port ssh,rdp and telnet. but,upon checking the logs, traffics was block using this rule with destination ports for others not specified in the rule(dns, snmp,ldap etc.). Is there anyone who also experience this?

[balaji.bandi]

No, that's not it should be working like that. Suppose you're using FMC, you can drill down and check which rule this is hitting in the events.

By default, the firewall blocks everything; you need to have allow rules.

[komiks]

correct. but we created a deny rule to a specific ip addresses to disallow rdp for these ip. but logs shows it blocks also dns,snmp,ntp.

[balaji.bandi]

As I mentioned, review the ACP and check the events drill-down. Is the same policy hitting or any other?

Or is this problem you're seeing after upgrading the code to 7.6.2?