Severity High and medium action are getting allow instead of block

[CyberEye]

Hi All,

After upgrade to 9.1.5, i noticed the Severity level high and medium threat actions are allowed and some of them are getting sinkhole. Please let us know if anyone knows why it's getting alert instead of the block in high severity. Attached screenshots

[mivaldi]

The Severity based rules are for Anti-Spyware. There is no Severity based rules for Anti-Spyware DNS.

For Anti-Spyware DNS, you define actions based on Content DNS signatures, DNS Security DNS Categories, or EDL's of type Domain.

[CyberEye]

@mivaldi thanks for reply.

So is this expected behaviour? The same url it's getting sinkhole alternatively. I cross checked same in other firewall which is running 9.0 os and confirmed all the high, Medium and critical named as DGA Domain and spyware type are sinkholed.

[mivaldi]

URL's are HTTP traffic, so they don't get sinkholed. URL's are subject to URL Filtering.

Sinkhole is applied to domains, which is DNS traffic.

Please open a Support case so we can work with you and understand the question better.

We can come back to this post at the end of the case to share our findings with the community.