Global Firewall Policies

Configuration > Overlays & Security > Security > Global Firewall Policies

Use the Global Firewall Policies tab to define firewall policies for all appliances across your network. These firewall policies manage traffic between firewall zones.

• Zones are created on the Orchestrator. A zone is applied to an interface.

• By default, traffic is allowed between interfaces labeled with the same zone. Any traffic between interfaces with different zones is dropped. You can create exception rules (firewall policies) to allow traffic between interfaces with different zones or between their segments and firewall zones.

• When Routing Segmentation (VRF) is enabled:

  • By default, traffic is allowed between interfaces labeled with the same zone and the same segment. Any traffic between different zones or between different segments is dropped.

  • Define your firewall policies from the Routing Segmentation (VRF) tab.

  • Do not use templates. If a firewall policy template is applied while segmentation is enabled, it applies only within the default segment. It overrides the default security policy defined on the Routing Segmentation (VRF) tab. This prevents a traffic disruption when segmentation is enabled for the first time, and during a migration to segments. After the migration process finishes, remove the security policy template.

• If Routing Segmentation is disabled, define firewall policies by creating templates. You can then apply the template to interfaces and overlays.

• The Global Firewall Policies tab can be viewed in both Matrix View (default) and Table View. Click the icons at the top of the tab to toggle between views.

• To view real-time or stored (historical) security logs from EdgeConnect appliances, click Security Log Viewer.

• To view statistics on various flows, packets, and bytes dropped or allowed by a zone-based firewall for a given time range, click Firewall Drops. For information about troubleshooting flows that were denied by the firewall with the reason “outbound pkt new dst zone” or “Zone change detected on outbound packet,” see this troubleshooting video.

• Clicking the edit icon in the Actions column of an appliance opens the Global Firewall Policy dialog box, which shows the applied firewall policy.

  NOTE: The edit icon is conditionally available. It is enabled for single-appliance selections and disabled for multi-appliance selections.

Global Firewall Policies Tab

Use the Global Firewall Policies tab to manage your firewall policies by adding or modifying rules.

1. Using the icons at the top of the tab, click either Matrix View or Table View.

2. Select a Source segment and a Destination segment from the drop-down menus.

3. Select a default logging level from the Log ‘deny all’ events at level drop-down menu.

4. In Matrix View, click the cell at the intersection of the source and destination zones to open the Zone <name> to Zone <name> dialog box, and then click the edit icon in the Actions column to open the rule editor. In Table View, click the edit icon in the Actions column of a rule to open the rule editor.

5. To create a new rule, click Add rule.

6. Modify the following fields for a new or existing rule:

   Field	Description
   Priority	Priority of the rule.
   Match criteria (optional)	Click to open the Match Criteria dialog box and add or modify match criteria for the rule.
   Action	Select the action to apply to traffic matching the rule: Allow—Matching traffic is allowed. Deny—Matching traffic is denied. Inspect—Matching traffic is inspected by the Intrusion Detection System (IDS).
   Enabled	Select the check box to enable the rule. Clear the check box to disable the rule.
   Logging	Select the logging level to apply when logging matches the specific rule. To disable logging for matching traffic, select None.
   Tag (optional)	Enter a tag to include in logs for matching events.
   Comment (optional)	Add comments about the rule.

7. Click Done.

8. Click Done again.

Wildcard-based Prefix Matching Rules

• When using a range or a wildcard, the IPv4 address must be specified in the 4-octet format, separated by the dot notation. For example, A.B.C.D.

• To specify a range, use a single dash (-). For example, 128-129.

• To specify a wildcard, use an asterisk (*).

• You can use a range and a wildcard in the same address, but each octet can contain only one of them or the other. For example, 10.136-137.*.64-95.

• Use a wildcard only to represent a complete octet. For example, 10.13*.*.64-95 is not supported. Use 10.130-139.*.64-95 to specify this range.

• These rules also apply to IPv6 addresses.

• CIDR notation and (range or wildcard) are mutually exclusive in the same address. For example, 192.168.0.1-127/24 is not supported. Use either 192.168.0.0/24 or 192.168.0.1-127.

• Prefix-matching rules apply to the following policies only: Route, QoS, Optimization, NAT, Security, and ACLs.