Use the Create Rule page to configure firewall rules that control transit traffic within a context (source zone to destination zone). The traffic is classified by matching its source and destination zones, the source and destination addresses, and the application that the traffic carries in its protocol headers with the policy database.
Security Director allows a device to have a device-specific policy and to be part of multiple group policies. Rules for a device are updated in this order:
Rules within Policies Applied Before 'Device Specific Policies' take priority and cannot be overridden. However, you can override rules within Policies Applied After 'Device Specific Policies' by adding an overriding rule in the Device-Specific Policies. In an enterprise scenario, “common-must-enforce” rules can be assigned to a device from the Policies Applied Before ‘Device Specific Policies’, and “common-nice-to-have” rules can be assigned to a device from the Policies Applied After ‘Device Specific Policies’.
Note: An exception can be added on a per device basis in “Device-Specific Policies” . For a complete list of rules applied to a device, select Configure > Firewall Policy > Devices. Select a device to view rules associated with that device.
Configuring Firewall Policy Rule Settings
To configure a firewall policy rule:
The Create Rules page appears.
Note: To edit and create rules inline, click the policy to make the fields editable
The rules you configured are associated with the selected policy.
Table 105: Firewall Policy Rules Setting
Setting | Guideline |
|---|---|
General Information | |
Rule Name | Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the; maximum length is 63 characters. |
Description | Enter a description for the policy rules; maximum length is 1024 characters. Comments entered in this field are sent to the device. |
Identify the traffic that the rule applies to | |
(Source) Zone | For SRX Series devices, specify a source zone (from-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context. For MX Series routers, this field acts as an ingress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the ingress key by selecting the aggregated multiservices (AMS) value. Polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy. |
(Source) Address(es) | Enter one or more address names or address set names. Click Select to add source addresses. On the Source Address page, in the Address Selection field, click Include to add the selected source addresses to the rule. Click Exclude to exempt the selected source addresses from the rule. In the Contains field, click Any Address to disable the any option from the source addresses list builder. See Creating Addresses and Address Groups. |
(Source) Src. ID | Specify the source identity (users and roles) to be used as match criteria for the policy. You can have different policy rules based on user roles and user groups. Click Select to specify source identities to permit or deny. On the Source ID page, you can select a source identity from the available list or you can make a new identify by clicking Add New Source ID. |
(Destination) Zone | For SRX Series devices, specify a destination zone (to-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context. For MX Series routers, this field acts as an egress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the egress key by selecting the aggregated multiservices (AMS) value. Polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy. |
(Destination) Address(es) | Select one or more address names or address sets. Click Select to add destination addresses. On the Destination Address page, in the Address Selection field, click Include to add the selected destination addresses to the rule. Click Exclude to exempt the selected destination addresses from the rule. In the Contains field, click Any Address to disable the any option from the destination addresses list builder. See Creating Addresses and Address Groups. |
(Service Protocols) Services | Select one or more service (application) names. Select the Include, Any Service to disable the any option in the services list builder. Clear the Any Service check box to permit or deny services from the services list builder available column. Click Add New Service to create a service. See Creating Services and Service Groups. |
Advanced Security | |
Rule Action |
|
Advanced Security | Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria. Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria. When the traditional policy is not enough, select application identification components to create an advanced security profile for the policy:
|
Rule Options | |
Profile | Select a default profile or a custom profile, or you can inherit a policy profile from another policy. Policy profile specifies the basic settings of a security policy. See Creating Firewall Policy Profiles. |
Schedule | Policy schedules allow you to define when a policy is active, and thus are an implicit match criterion. You can define the day of the week and the time of the day when the policy is active. For instance, you can define a security policy that opens or closes access based on business hours. Multiple schedulers can be applied to different policies, but only one scheduler can be active per policy. Select a pre-saved schedule and the schedule options are populated with the selected schedule’s data. Click New to create another schedule. |
Rule Analysis | |
New Rule, Perform Analysis | Select this option if you want to analyze your rules to avoid any anomalies. |
Rule Placement | |
Location/Sequence | Displays the sequence number and the order in which the rule is placed. |