Match > Source

Specifies the address object that is the source of the traffic.

Select any to monitor network traffic originating from any IP address.

Note: For guidelines on specifying match parameters, see the IDP Concepts and Examples Guide.

Match > Destination

Specifies the address object that is the destination of the traffic, typically a server or other device on your network.

Select the destination object.

Note: You can also negate one or more address objects to specify all destinations except the excluded object.

Match > Application

Requires one of the specified applications to match the session for the rule to be applied. The predefined list of applications is populated by the application identification feature. The application identification feature identifies the application regardless of port. Port-independent application identification simplifies rule configuration and ensures that you do not miss applications running on nonstandard ports. Hence it is recommended to use the application parameter instead of the service parameter whenever possible.

Right-click the table cell and make your required modifications.

If you specify named values for both service and application, only the application value is used.

Specify Any when creating a service-based rule or when creating an application-based rule where the application list consists only of extended application objects.

You can use the Shared Objects for Policy viewer (located below the rule editor) to browse application objects and explore object properties. You can create custom application objects.

Note: To apply an APE action to all traffic matching source and destination parameters, set both the service parameter and the application parameter to Any.

Extended application matching is more granular than application matching. Do not select HTTP in the application column if you also plan to specify extended application objects in the same rule. If you specify HTTP and HTTP:Facebook, for example, the rule matches HTTP or HTTP:Facebook. The result is indistinguishable from a rule matching only HTTP. We recommend you list rules targeting Extended Applications before a rule targeting HTTP.

Action

Specifies which actions to perform against attacks that match rules in your security policy.

Right-click the table cell and select any one of the following options:

• None — IDP takes no action against the connection.
• Drop Packet — IDP drops a matching packet before it can reach its destination but does not close the connection.
• Drop Connection — IDP drops the connection without sending an RST packet to the sender, preventing the traffic from reaching its destination.
• Close Client — IDP closes the connection to the client and not to the server.
• Close Server — IDP closes the connection to the server and not to the client.
• Close Client and Server — IDP closes the connection and sends a RST packet to both the client and the server.
• Diffserv Marking — Assigns the differentiated service value you specify to the packet. This action is useful when your network has a class of service (CoS) design, and you want to use the IDP Series device to rewrite the CoS code point based on APE rules processing. The CoS rules you have implemented for the next devices in the network path ultimately determine the effect on the transmission rate.

  Note: In sniffer mode, this action has no effect because the IDP Series device is not in the path of network traffic.

• Rate Limiting — IDP enforces a rate limit for all current sessions that match the rule (separate limits for client-to-server and server-to-client traffic). If the limit has not been reached, IDP forwards the packets. If the limit has been reached, IDP behaves as if no bandwidth is available. The rate limits that are best suited for your business case depend on the bandwidth for your links. If you have a 1-Gbps link and want no more than 10% available to peer-to-peer traffic, the sum of the rate limits you specify for all peer-to-peer rules must be less than 102.4 Mbps (in each direction).

  You configure separate rate limits for client-to-server and server-to-client directions. For peer-to-peer traffic, we recommend that you set the same rate for each direction.

  Note: For TFTP traffic, all traffic is considered client-to-server traffic. A TFTP server responds to get requests by establishing an ephemeral port from which to send the reply. In this case, both directions appear to the IDP Series device as client-to-server flows. We recommend you set the same rate for each direction. In sniffer mode, this action has no effect because the IDP Series device is not in the path of network traffic

• Diffserv Marking & Rate Limiting — Takes both actions as described for Diffserv Marking and Rate Limiting.

VLAN Tag

Specifies rules to traffic on certain VLANs. Normally, for a rule to take effect, it must match the packet source, destination, service, and attack objects. If the VLAN cell is populated with a value other than any, then the rule will also consider the packet’s VLAN tag when determining a match.

Right-click the table cell to assign a VLAN object to a rule or to set the VLAN tag value to none.

Comments

Adds notations about the rule. This setting is optional and does not affect the functionality of the security policy rule.

Right-click the table cell and select Edit Comments to display a dialog box where you can make notations about the rule.