Unable to stop IGMP traffic logging

[stephenw10]

Also to confirm can I assume you did not see these logged before you enabled logging n the rule during testing?

And that you have rebooted the firewall since this started and it makes no difference?

[jch]

@stephenw10

Yes, i confirm :

In addition :

Block rules :

The filter block rules has no effect

[jch]

@stephenw10

Right, it was after using the logging options in the rules that the logs appeared.
I haven't performed a reroot or reboot since the production deployment, but i can't do it now, i have to wait until tonight, i'll let you know

Many thanks for your help !

[stephenw10]

The floating rule is not set as quick so it would still hit the pass rule on LAN after that. Though it shouldn't because the block rule on LAN should catch it.

Try setting that floating rule to 'quick' though.

[pst]

@jch have you tried removing the destination in the rule, it is a broadcast address? Your rules shows that the the the IGMP rule is never triggered, states = 0/0. I found an old and disabled IGMP reject rule among my rules and I remember that one working. It is defined without destination address.

[jch]

@stephenw10

I added the 'Quick' option but the problem remains :

[jch]

@pst

Same result :

[stephenw10]

Hmm, try enabling 'IP Options' in the advanced settings on that floating block rule.

Normally you would need to enable IP Options to pass multicast traffic like that.

[jch]

@stephenw10

Thanks for this advice, i checked this option but IGMP flows continue to be logged as 'Pass' traffic.
I'm going to do a reboot later, i'll let you know, Thanks !

[jch]

@stephenw10

Problem solved, IGMP logs flooding disappeared after reboot, it's some kind of bug ..
Thanks again for your help :)

[stephenw10]

Hmm, bizarre! Glad it was solved.