Seq.

Displays the sequence number of rules in a zone pair.

Rule Name

Displays the rule name.

Source Address

Displays the name of the source address or address set for the rule.

Destination Zone

Displays the destination zone that is specified in the zone pair for the rule.

Dynamic Application

Displays the dynamic application names for match criteria in application firewall rule set.

An application firewall configuration permits, rejects, or denies traffic based on the application of the traffic.

Action

Displays the actions that need to take place on the traffic as it passes through the firewall.

Advanced Security

Displays the security option that apply for this rule.

Policy rematch

Specifies that a policy is added that has just been modified to a deferred action list for reevaluation. For every session associated with the policy, the device reevaluates the policy lookup. If the policy is different from the one associated with the session, the device drops the session. If the policy matches, the session continues.

Select the check box.

Early ageout

Specifies the amount of time before the device aggressively ages out a session from its session table.

Enter a value from 1 through 65,535 seconds. The default value is 20 seconds.

Low watermark

Specifies the percentage of session table capacity at which the aggressive aging-out process ends.

Enter a value from 0 through 100 percent. The default value is 100 percent.

Enable SYN proxy protection

Enables SYN proxy defenses against SYN attacks.

Select the check box.

Force IP reassembly

Specifies reassemble all IP fragmented packets before forwarding.

Route change to nonexistent route timeout

Specifies the session timeout value on a route change to a nonexistent route.

Enter a value from 6 through 1800 seconds.

Enable MSS override for all packets

Enables maximum segment size override for all TCP packets for network traffic.

Select the check box.

Enter an maximum segment size value from 64 through 65,535.

Enable MSS override for all GRE packets entering an IPsec tunnel

Enables maximum segment size override for all generic routing encapsulation packets entering an IPsec tunnel.

Select the check box.

Enter a maximum segment size value from 64 through 65,535 bytes. The default value is 1320 bytes.

Strict SYN-flag check

Enables the strict three-way handshake check for the TCP session. This check enhances security by dropping data packets before the three-way handshake is done. By default, this check is disabled.

Select the check box.

Disable SYN-flag check (tunnel packets)

Disables the first packet check for the SYN flag when forming a TCP flow session.

Select the check box.

RST sequence check

Specifies that the TCP sequence number in a TCP segment can be checked, with the RST bit enabled. This matches the previous sequence number for a packet in that session or is the next higher number incrementally.

Select the check box.

Rule Description

Specifies a description for the security policy.

Enter a description for the security policy.

Address(es)

Specifies the source address of the rule.

Select the Address(es) for the policy by clicking Select The Source Address page appears.

Select the Address for this policy. The options available are:

• Any Address—Selecting this will include any address as the source address.

• Include Specific—Selects an address book entry from the available list or you can make a new address book entry by selecting Add New Source Address and creating a new source address in the Create Address page.

• Exclude Specific—Selects an address book entry from the available list or you can make a new address book entry by selecting Add New Source Address and creating a new source address in the Create Address page.

Address(es)

Specifies the source address of the rule.

Select the Address(es) for the policy by clicking Select The Destination Address page appears.

Select the Address for this policy. The options available are:

• Any Address—Selecting this will include any address as the destination address.

• Include Specific—Selects an address book entry from the available list or you can make a new address book entry by selecting Add New Source Address and creating a new source address in the Create Address page.

• Exclude Specific—Selects an address book entry from the available list or you can make a new address book entry by selecting Add New Source Address and creating a new source address in the Create Address page.

Service(s)

Select the services that you want to permit or deny in the rule.

Select the services to permit or deny. You can choose a service from the available list.

Rule Action

Specifies the action taken when traffic matches the criteria. Available options are:

• Permit

• Deny

• Reject

Select an option.

1. App Firewall—Select the application firewall from the dropdown list.
2. IPS—Select Off or On from the dropdown list. If you select On, the IPS Policy field will be disabled. If you select Off, you may select the IPS Policy from the dropdown list.
3. UTM—Select the UTM policy to associate with this rule from the dropdown list, which shows all the UTM policies available.

   If you want to create a new UTM policy, click Add New, which enables you to create a new UTM policy in the Create UTM Policies Wizard. To know more about this wizard refer Configure>Security>UTM page in J-Web.

4. SSL Proxy—Select the SSL proxy policy to associate with this rule from the dropdown list, which shows all the SSL proxy profiles that are created using the Configure>Security>SSL Proxy page in J-Web. After you associate, the SSL proxy policy will be applied to the traffic.
5. IPSec VPN—Select the IPsec VPN tunnel from the dropdown list.
6. Pair Policy Name—Select the name of the policy with the same IPsec VPN in the opposite direction to create a pair policy.
7. Threat Prevention Policy—Select the configured threat prevention policy from the dropdown list. To create a threat prevention policy go to Configure>Security>SkyATP or Threat Prevention>Policies.
8. ICAP Redirect Profile—Select the configured ICAP Redirect profile name from the dropdown list.

Deny—Block and drop the packet, but do not send notification back to the source.

Reject—Block and drop the packet and send a notice to the source host.

• For TCP traffic—Sends TCP RST.

• For UDP traffic—Sends ICMP destination unreachable, port unreachable message (type 3, code 3).

• For TCP and UDP traffic—Specifies action denied.

Logging/Count

Log at Session Init Time

Specifies that an event is logged when the session is created.

Select the check box.

Authentication

Type

Specify the type of firewall authentication for this rule.

Select the type of firewall authentication from the dropdown list. The options available are: None, Pass-through, User-firewall, and Web-authentication.

Destination Address Translation

Specifies the action to be taken on a destination address translation.

Select the action to be taken on a destination address translation. The options available are: None, Drop Translated, Drop Untranslated.

Enable TCP-SYN

Disables or enables the checking of the TCP SYN bit before creating a session. By default, the device checks that the SYN bit is set in the first packet of a session. If it is not set, the device drops the packet.

Select if you want enable TCP-SYN.

Add Rule Before

Adds a new rule before the selected rule.

Copy

Copies a selected rule and enables you to paste it before or after the selected rule.

Paste

Pastes the copied or cut rule before or after the rule selected for copy.

Move Rule

Organizes records. Select a rule and choose Move up, Move down, Move to top, or Move to bottom to reposition the rule.

Enable

Enables the selected rule if it was disabled.