Step 5: Enable Logging for Traffic that Doesn’t Match Any Rules
Traffic that does not match any of the rules you defined will match the predefined interzone-default rule at the bottom of the rulebase and be denied. For visibility into the traffic that is not matching any of the rules you created, enable logging on the interzone-default rule:
- Select the interzone-default row in the rulebase and click Override to enable editing on this rule.
- Select the interzone-default rule name to open the rule for editing.
- On the Actions tab, select Log at Session End and click OK.
- Create a custom report to monitor traffic that hits this
- Select MonitorManage Custom Reports.
- Add a report and give it a descriptive Name.
- Set the Database to Traffic Summary.
- Select the Scheduled check box.
- Add the following to the Selected Columns list: Rule, Application, Bytes, Sessions.
- Set the desired Time Frame, Sort By and Group By fields.
- Define the query to match traffic hitting the interzone-default
rule:(rule eq 'interzone-default')
- Commit the changes you made to the rulebase.
Log Data Center Traffic that Matches No Interzone Rules
By default, the firewall denies traffic between data center zones (interzone traffic) that matches no Security policy allow rule. Log and examine this traffic to ...
Remove the Temporary Rules
Remove the Temporary Rules After several months of monitoring your initial internet gateway best practice security policy, you should see less and traffic hitting the ...
Create Data Center Traffic Block Rules
Block traffic you know you don’t want in your data center and use block rules to discover unknown applications and users. ...
Security Policy Security policy protects network assets from threats and disruptions and aids in optimally allocating network resources for enhancing productivity and efficiency in business ...
What Data Center Traffic to Log and Monitor
The types of data center traffic you should log and monitor, the tools you can use to analyze the traffic, and how to best utilize ...
Follow Post-Deployment Data Center Best Practices
This checklist shows you how to monitor and maintain your best practice data center deployment to keep your network safe as applications and circumstances evolve. ...
Monitor and Fine Tune the Policy Rulebase
Monitor and Fine Tune the Policy Rulebase A best practice security policy is iterative. It is a tool for safely enabling applications, users, and content ...
Creating and Managing Policies
Creating and Managing Policies Select the Policies Security page to add , modify, and manage security policies: Task Description Add To add a new policy ...
Monitor Data Center Block Rules and Tune the Rulebase
Monitor traffic that you explicitly block so that you can investigate potential attacks and evaluate whether you should allow any of the blocked traffic. ...