Check that both conditions are true: - The source IP address is not the subnet broadcast IP address
of the ingress interface.
- The source IP address is routable over the exact ingress interface.
If
either condition is not true, discard the packet.
The
firewall does not consider Policy Based Forwarding (PBF) rules during
this check; it considers only routes listed in the routing table
(RIB), that is, routes listed under the CLI output for show routing route. For
a firewall in Common Criteria (CC) mode, you can enable logging
for discarded packets. On the firewall web interface, select .
In the Manage Logs section, select Selective Audit and
enable Packet Drop Logging. | 
