Hi. This might sound obvious, but could it be that the flowspec route pushed by Corero contains a transport layer port number and the firewall filter does not match IP fragments? Martin