TP, Firewall, or _______?

[Jan Janowski]

Been considering posting this for a while now.
RT2600ac, Latest firmware, with TP and firewall running.
When I go into TP/Statistics, I see probes from China. TP blocks them. Good.
When I go into Firewall, I see all probes from China IP are blocked, and hits indicating it happened, yet in TP it posts IP from China, that’s blocked. Confusing, but Good.
Questions:
Is TP Statistics showing what’s hitting router Before TP Does it’s work? OR, After TP does it’s work?? Does Statistics show TP being applied Before, or After Firewall? OR, is Firewall IP Region block being circumvented, say by impersonating an IP from a country whose region is NOT being blocked? And if that is true, then, why does TP indicate a China IP?

I’m just trying to determine what I’m observing.

Thanks for any clarifications!

 

[Jan Janowski]

In addition to the above.... At the bottom of Firewall list of rules is a rule that indicates if nothing in the above rules are matched, Deny ALL Access..... So I in affect have 2 rules in Firewall blocking China... so if someone circumvents one, the other should be active later down the list.... and that, too is getting "Hits"... Yet TP still shows a China "Event" that's blocked...

 

[Jan Janowski]

Found communications from years ago, buried in printouts.
Different routes depending on inward or outward direction of packet.
Inbound appears to be TP then Firewall.
Outbound appears to be Firewall then TP.

Am I to assume that TP, Firewall and SA all react to different types of threats, and one could conceivably ‘get through’ one to be stopped by another??

Just trying to get my head around what I’m seeing — looking for confirmation or correction.

Again, looking forward to any corrections.
Thanks….

 

[fredbert]

Am I to assume that TP, Firewall and SA all react to different types of threats, and one could conceivably ‘get through’ one to be stopped by another??

Yes.

As for the China scenario: FW works with packet header data not payload, so will block on that only. TP may consider payload data like XFF or any client env info.

I’m sure you were part of a thread at The Community that discussed which feature applied in what order. There was a flow diagram if I recall.

 

[Jan Janowski]

Yes... Before I had the workflow, and not the real world example... Now I've seen it happen... and only when I put the two together did I understand what's going on... with the data that all 3 programs are approaching it from different directions... Tnx