;COMMENT: Log rejected packets - both directions
;DESCRIPTION: All packets rejected by the Firewall Plugin, IPSec Plugin, Fragmentation or NAT are logged to the file 'droppkts.log'. Additionally logs when one remote IP address is responsible for 10 dropped (incoming) packets within one hour.

Dropped-IPSec	
		Comment = "Warn on dropped packets (by IPSec)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Packet dropped by IPSec",
		Log-Details = "IPSec drops packets that fail to comply with the defined IKE policies. It is not uncommon that a few packets can be dropped during IPSec key re-negotiations, but severe floods of dropped packets suggests an attack.",
		Log-Severity = Medium,
		Packet-Feature = Dropped-IPSec

Dropped-Firewall	
		Comment = "Warn on dropped packets (by Firewall)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message action_rule dump",
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Packet dropped by Firewall ACL",
		Log-Details = "The Firewall security policy caused a packet to be dropped.",
		Log-Severity = Medium,
		Packet-Feature = Denied

Dropped-NAT	
		Comment = "Warn on dropped packets (by NAT)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Packet dropped by NAT",
		Log-Details = "The Network Address Translation code dropped a packet. The NAT engine will drop unsolicited incoming traffic.",
		Log-Severity = Medium,
		Packet-Feature = Dropped-NAT

Dropped-Fragment	
		Comment = "Warn on dropped packets (by Fragmenting engine)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Packet dropped by fragmentation",
		Log-Details = "Internet traffic can be broken into packet-sized segments for transmission. The fragmentation code drop packets that fail to comply with the standard for fragmentation. Attackers sometime use non-standard values for the fragmentation, but problems can also been seen in conjunction with malfunctioning network equipment.",
		Log-Severity = Medium,
		Packet-Feature = Dropped-Fragment

Dropped-Other	
		Comment = "Warn on dropped packets",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Packet dropped by unclassified checking",
		Log-Details = "This type of packet drop indicates that a packet was dropped by a periodic failure or otherwise unclassified checking. Such temporary checks include (but not limited to) filled buffers, temporary IP stack failure, router failure.",
		Log-Severity = Medium,
		Packet-Feature = Dropped-Other

Dropped-Malformed	
		Comment = "Warn on dropped packets (malformed)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-File = "firewall/logs/droppkts.log",
		Log-Message = "Malformed packet dropped",
		Log-Details = "The Firewall drops packets that violate the standard for IP transmission. In order to bypass logging mechanisms or exploit IP stack vulnerabilities, attackers sometimes use non-standard values for various fields in the packet headers. Malformed packets have also been observed in conjunction with malfunctioning or overloaded network equipment.",
		Log-Severity = Medium,
		Packet-Feature = Dropped-Malformed
