Appliance Security Policies

Configuration > Overlays & Security > Security > Appliance Security Policies

The Appliance Security Policies tab lists the security policies for your appliances. These security policies manage traffic between firewall zones.

  • Zones are created on the Orchestrator. A zone is applied to an interface.

  • By default, traffic is allowed between interfaces labeled with the same zone. Any traffic between interfaces with different zones is dropped. You can create exception rules (security policies) to allow traffic between interfaces with different zones or between their segments and firewall zones.

  • When Routing Segmentation (VRF) is enabled:

    • By default, traffic is allowed between interfaces labeled with the same zone and the same segment. Any traffic between different zones or between different segments is dropped.

    • Define your security policies from the Routing Segmentation (VRF) tab.

    • Do not use templates. If a security policy template is applied while segmentation is enabled, it applies only within the default segment. It overrides the default security policy defined on the Routing Segmentation (VRF) tab. This prevents a traffic disruption when segmentation is enabled for the first time, and during a migration to segments. After the migration process finishes, remove the security policy template.

  • If Routing Segmentation (VFR) is disabled, define security policies by creating templates. You can then apply the template to interfaces and overlays.

  • To toggle between views, click the Matrix View (default) or Table View filter at the top of the tab.

  • To view statistics on various flows, packets, and bytes dropped or allowed by a zone-based firewall for a given time range, click Firewall Drops. For information about troubleshooting flows that were denied by the firewall with the reason “outbound pkt new dst zone” or “Zone change detected on outbound packet,” see this troubleshooting video.

  • To define policies on all appliances within your network, click Global Firewall Policies. Use the matrix and table views to further specify your policies.

  • Clicking the edit icon in the Actions column of an appliance opens the Appliance Security Policy dialog box, which shows the applied security policy. Any changes you make are local to that appliance. Making changes from this dialog box is not recommended.

    NOTE: The edit icon is available when you select a single appliance. It is disabled when you select multiple appliances.

Appliance Security Policies Tab

Use the Appliance Security Policies tab to manage your security policies by adding or modifying rules.

  1. Using the icons at the top of the tab, click either Matrix View or Table View.

  2. Select a Source segment and a Destination segment from the drop-down menus.

  3. Select a default logging level from the Log ‘deny all’ events at level drop-down menu.

  4. In Matrix View, click the cell at the intersection of the source and destination zones to open the Zone <name> to Zone <name> dialog box, and then click the edit icon in the Actions column to open the rule editor. In Table View, click the edit icon in the Actions column of a rule to open the rule editor.

  5. To create a new rule, click Add rule.

  6. Modify the following fields for a new or existing rule:

    Field Description
    Priority Priority of the rule.
    Match criteria (optional) Click Match everything to open the Match Criteria dialog box and add or modify match criteria for the rule.
    Action Select the action to apply to traffic matching the rule:

    Allow—Matching traffic is allowed.

    Deny—Matching traffic is denied.

    Inspect—Matching traffic is inspected by the Intrusion Detection System (IDS).
    Enabled Select the check box to enable the rule. Clear the check box to disable the rule.
    Logging Select the logging level to apply when logging matches the specific rule. To disable logging for matching traffic, select None.
    Tag (optional) Enter a tag to include in logs for matching events.
    Comment (optional) Add comments about the rule.

  7. Click Done.

  8. Click Done again.

Wildcard-based Prefix Matching Rules

  • When using a range or a wildcard, the IPv4 address must be specified in the 4-octet format, separated by the dot notation. For example, A.B.C.D.

  • To specify a range, use a single dash (-). For example, 128-129.

  • To specify a wildcard, use an asterisk (*).

  • You can use a range and a wildcard in the same address, but each octet can contain only one of them or the other. For example, 10.136-137.*.64-95.

  • Use a wildcard only to represent a complete octet. For example, 10.13*.*.64-95 is not supported. Use 10.130-139.*.64-95 to specify this range.

  • These rules also apply to IPv6 addresses.

  • CIDR notation and (range or wildcard) are mutually exclusive in the same address. For example, 192.168.0.1-127/24 is not supported. Use either 192.168.0.0/24 or 192.168.0.1-127.

  • Prefix-matching rules apply to the following policies only: Route, QoS, Optimization, NAT, Security, and ACLs.