Create Security Rules on Cloud NGFW for AWS
Security rules protect network assets from threats and disruptions and helps to optimally allocate network resources for enhancing productivity and efficiency in business processes. On Cloud NGFW for AWS, individual security rules determine whether to block or allow a session based on traffic attributes, such as the source and destination IP address, source and destination FQDNs, or the application.
All traffic passing through the firewall is matched against a session and each session is matched against a rule. When a session match occurs, the NGFW applies the matching rule to bidirectional traffic in that session (client to server and server to client). For traffic that doesn’t match any defined rules, the default rules apply.
Security policy rules are evaluated left to right and from top to bottom. A packet is matched against the first rule that meets the defined criteria and, after a match is triggered, subsequent rules are not evaluated. Therefore, the more specific rules must precede more generic ones in order to enforce the best match criteria.
After creating a rulestack, you can now create rules and add them to your rulestack.
You can view the number of times that traffic has hit a specific rule by navigating to
. The Usage tab display the number of times the suspected rule has been triggered by taffic passing through the NGFW. The hit counter refreshes every 15 seconds.
Additionally, you can view the rule hit counter by selecting
. When view the hit counter from the NGFWs menu, the hit counter diaplys the number of times the chosen rule has been triggered on that specific NGFW.
- Selectand select the target rulestack for your new rule.ManageRulestacks
- ClickCreate New. When adding a rule to a global rulestack, you must choosePre RuleorPost Rule.
- Enter a descriptiveNamefor your rule.
- (Optional) Enter aDescriptionof your rule.
- Set theRule Priority.The rule priority determines the order in which the rules are evaluated. Rules with a lower priority are evaluated first. Additionally, each rule within a rulestack.
- By default, the security rule isEnabled. UncheckEnabledto disable the rule. You can enable or disable a rule at anytime.
- Set theSource.
- SelectAnyorMatch.SelectingAnymeans the traffic is evaluated against the rule regardless of source.
- If you selectMatch, click the add icon ( ) specify at least one Source object—IP Address (CIDR), Prefix List, Countries, or Intelligent Feed (IP Type).
- Set theDestination.
- SelectAnyorMatch.SelectingAnymeans the traffic is evaluated against the rule regardless of destination.
- If you selectMatch, click the add icon ( ) and specify at least one Destination object—IP Address (CIDR), Prefix List, FQDN List, Countries, or Intelligent Feed (IP Type).
- SetApplication (App-ID)Granular Control.
- ChooseAnyorSelect.When choosingAny, traffic is evaluated regardless of the application. By specifying an application(s), traffic is evaluated against the rule if the traffic matches the specified application.
- If you choose Select, click the add icon ( ) and specify the application or applications.
- SetURL CategoryGranular Control.
- ChooseAnyorMatch.When choosingAny, traffic is evaluated regardless of the URL. By specifying an application(s), traffic is evaluated against the rule if the traffic matches the specified URL category or Intelligent Feed (URL Type).
- If you chooseMatch, selectURLCategoryNamesorFeedsand click the add icon ( ). From the drop-down, select a URL category or intelligent feed.
- SetPort & ProtocolGranular Control.
- Chooseapplication-default,Any, orSelect.When choosingAny, traffic is evaluated regardless of the port and protocol. By specifying a port and protocol, traffic is evaluated against the rule if the traffic matches the specified port and protocol.
- If you choose Select, select the protocol from the drop-down and enter the port number. You can specify a single port number, or, use commas to specify multiple ports. For example: 80, 8080.
- Set the Action the firewall takes when traffic matches the rule—Allow,Deny,Reset Server, orReset Bothclient and server.
- EnableOutbound TLS Decryption.
- After creating rules for your rulestack, validate or deploy your configuration.
Recommended For You
Recommended videos not found.