Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have this issue where one of our MacBook Air (Mountain Lion) users is periodically getting added to the Blocked Sites list within our Watchguard XTM-21 Appliance (XTM21-W). Couple of questions:

  • Is there something new in Mountain Lion that I can disable and/or dial down so that it doesn't get blocked?
  • What can I do on the Watchguard side to mitigate this problem, besides adding the MacBook to the exclude list?

The only information I have with regard to our error is that the MacBook Air showed up on the block list for an IP Scanning Attack.

share|improve this question

There's a knowledgebase article on the Watchguard site, but you need to be logged in to get to it, so I quote:


Why are internal IP addresses blocked by Default Threat Protection?


In Fireware XTM v11.x, when the Block Port Space Probes and Block Address Space Probes check boxes are selected in the Default Packet Handling configuration, all incoming traffic on all interfaces is examined by the Firebox or XTM device.

Some internal computers, usually DNS or email servers, could be unexpectedly blocked due to IP scan, or port scan protection.

There are two options to protect against this. One option is to add those servers to the Blocked Site Exceptions list.

Another option is to increase the thresholds for port or address space probes. For more information, in "Setup > Default Threat Protection > Default Packet Handling".

I think you should check the computer to make sure it doesn't have any malicious software on it; I don't remember seeing anything to do with Macs triggering blocked sites, specifically.

share|improve this answer
Thanks. I did see this article before and did perform a scan on the system but it came up as fine. – slm Apr 13 '13 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .