Firewall Policies on NSM 8.3 not working

[ShawnB]

Good Day All,

I am new to the community, but new to McAfee products.

I have a NSP NS-7200 and NSM 8.3.7.7.

I have it monitoring among other places, the traffic inboud to my outside firewall

I am seeing some suspicious RDP traffic from Russia and Latvia. Specifically RDP: Microsoft Windows RDP Server Abnormal Termination

So I have set a I have set a Firewall policy to deny and log the traffic from source address Latvia and Russia to the destination IP address

I have set the firewall Rules to send to a syslog server and sent test logs and confirm that the syslog is receiving. as per this community thread

https://community.mcafee.com/t5/Network-Security-Platform-NSP/Where-i-can-find-the-firewall-events-i...

After saving and deploying  the policy to the sensor, I am still seeing the attack show up on my dashboard and analyzer several hours later, so I am thinking that the rule is NOT working. The syslog does not show any entries either

Any assistance on this?

[dfdfdgsdgfsf]

What version of code is the Sensor running?

Can you attach an image of the firewall rule you created and show us where/how it is assigned? 

As a side note, it is not recommended that you use the Sensors as an edge device. They should reside on the trusted side of the firewall.

[ShawnB]

Thanks for your reply

The sensor is software version: 8.3.5.32 Signature Set 9.8.42.3

The rule as follows

Thanks for the advice on the sensor edge facing. I do have it this way to at least be able to see the attacks on my public facing IP addresses, its reported better than my CheckPoint firewall provides. Also my firewalls are virtual, so it makes it a bit harder to configure the interfaces on the internal trusted side. I'll keep it in mind though for a reconfiguration.