I am getting the following log entry pretty frequently lately.
Act TIME If Source Destination
X17 22:21:53.381441 DMZ 192.168.1.100, port 80 220.127.116.11, port
The X means blocked. What does the 17 mean. Most entries do not have a
number under Act, while others will have anything from 2 to 17.
The DMZ is set up to allow everything except LAN. Why is this being
blocked? Why always a bunch of these entries together with just one