Add a Stacked Security Policy Rule
Learn how to add security policy rules for stacked security policies.
Each security policy set is a collection of security policy rules. A security policy set has default security policy rules which cannot be changed, removed, or deleted. You can create custom security policy rules to take precedence over the default security policy rules. You can directly add policy rules to a simple path stack by clicking a simple path stack and then clicking
Add Rule. For advanced stacks, select a stack, then a policy set within the stack, and then add policy rules to the policy set.
- Add a security policy rule to a simple security stack.
- Select.PoliciesStacked PoliciesSecuritySimpleSecurity StacksSelect a StackAdd Rule
- Select an action for the rule.Configure general allow or deny rules first, then add more specific access and deny rules and have them listed in higher priority order so that they are evaluated before the broader rules.On theInfotab:
- Enter aNamefor the policy rule, and optionally enter description and tags.
- Enter anorderbetween 1-65535 for the policy rule.An order of 1 indicates the highest priority for the policy rule. If you leave this field blank, the rule is given the least priority.
- (Optional)SelectDisable Ruleif you do not want the ION device to consider this rule.
- Select the action to take for traffic matching this rule as eitherAllow,Deny, orReject. The default action isAllow.
- Allow—Indicates that the ION device allows traffic that matches the parameters specified in the rule.
- Deny—Indicates that the ION device drops traffic without sending a RESET or ICMP HOST UNREACHABLE message to the client or server.
- Reject—Indicates that the ION device rejects traffic that matches the parameters specified in the rule and sends a RESET message to both the client and the server.
- (Optional)Configure services for the rule.Add protocols, source ports, and destination ports to make the policy rule more specific.On theServicestab:
- (Optional)ClickAdd Serviceto add protocols, source ports, and/or destination ports.
- (Optional)Select a protocol from theProtocoldrop-down.
- (Optional)SelectSource Port Rangesbetween 1 and 65535. ClickAdd Port Rangefor additional port ranges. You can add a maximum of 16 source port ranges.
- (Optional)SelectDestination Port Rangesbetween 1 and 65535. ClickAdd Port Rangefor additional port ranges. You can add a maximum of 16 destination port ranges.
- (Optional)Add zones and prefixes.While creating security policy rules, specify the source and destination zones to which the rule applies and establish one or more source and destination zones for each security rule. The source zone identifies the LAN network from where traffic originates, and the destination zone identifies traffic from the LAN network.Prefixes restrict access within a branch and filter out traffic to specific IP addresses within the particular source and destination zones.On theZones & Prefixestab:
- (Optional)Select a sourceZoneandPrefix.
- (Optional)Select a destinationZoneandPrefix.
- (Optional)Add applications.Applications are the core element of the security solution for controlling network traffic and implementing security policies. You can use the same application definitions and fingerprinting technologies for security policies, path selection for network policies, and for Quality of Service (QoS) implementation in QoS policies.On theApplicationstab:
You can select 256 applications for one policy rule.
- Select the applications to apply the policy rule.
- Add a security policy rule to an advanced security stack.
- Select.PoliciesStacked PoliciesSecurityAdvancedSecurity SetsSelect a Security SetAdd Rule
- Follow the steps above for adding a security policy rule to an advanced security stack.
Recommended For You
Recommended videos not found.