# Firewall default action
<a name="firewall-policy-v2-default-action"></a>

The firewall default action determines how the firewall engine handles traffic that reaches a hook without matching any firewall rule. The firewall engine is drop by default, so if you don't change this setting, traffic that you don't explicitly allow is dropped. The firewall default action applies only to the firewall engine. In a Next Generation policy, the IPS engine is pass by default and has no separate default-action setting.
+ **Drop** (default) – Network Firewall discontinues inspection of the traffic and blocks it from reaching its destination. Network Firewall records the drop in your logs if logging is configured.
+ **Accept** – Network Firewall allows traffic that doesn't match a firewall rule to continue. This makes the firewall engine pass by default rather than drop by default.

  Use this setting when you want the firewall to act as an intrusion prevention system (IPS) only, rather than as an access-control firewall. With an accept default action, the firewall engine passes traffic through to the IPS engine, and the IPS engine's rules provide the protection. This is a common configuration for a policy whose purpose is threat detection and prevention rather than access control. If the policy has a TLS inspection configuration attached, an **Accept** default action allows TLS-inspected traffic at any stage your firewall rules don't cover, so the IPS engine can inspect it. For more information, see [How rules are evaluated for TLS-inspected traffic](tls-inspection-policy-v2-tls-gate.md).
**Warning**  
Setting the firewall default action to **Accept** allows all traffic that you don't explicitly block through the firewall engine. Choose this setting only when you intend the firewall engine to allow traffic by default, and understand that it is a deliberate change away from the drop-by-default security posture.
+ **Alert** – Network Firewall allows traffic that doesn't match a firewall rule to continue, the same as **Accept**, and also records an alert log entry each time the default action is applied. This is especially useful while you're authoring a ruleset: with an alert default action, your logs show exactly which traffic is reaching the default action instead of matching one of your rules, so you can see what your allow list is still missing before you switch the default action to **Drop**. As with an **Accept** default action, if the policy has a TLS inspection configuration attached, an **Alert** default action allows TLS-inspected traffic at stages your rules don't cover, and logs it. See [How rules are evaluated for TLS-inspected traffic](tls-inspection-policy-v2-tls-gate.md).
+ **Reject** – Network Firewall blocks the traffic and sends a TCP reset packet back to the client so that the client can immediately establish a new session. This reset applies to TCP traffic. For non-TCP protocols there is no connection to reset, so Network Firewall drops the traffic, the same as the **Drop** action.