topic Re: policy, objects and smtp in Advanced Threat Prevention Discussions

policy, objects and smtp

PA200-1 — Tue, 29 Mar 2022 01:00:51 GMT

howdy,

I can not get my head around how to do this.

Allow smtp from a country but block every other service, application.

You can negate countries but not services/applications.

can one do any/any with an exception?

Thank you

Re: policy, objects and smtp

Adrian_Jensen — Tue, 29 Mar 2022 15:52:07 GMT

Your question is a bit open ended... Do you want to block everything but SMTP from a specific country? Or block all traffic to anywhere, except for SMTP from a specific country? Generally you are going to want to try and build rules with specific allows, followed by global drops for anything else.

Re: policy, objects and smtp

PA200-1 — Tue, 29 Mar 2022 19:58:52 GMT

Allow smtp from 1 specific country but block every other service, application from that 1 specific country.

Re: policy, objects and smtp

Adrian_Jensen — Tue, 29 Mar 2022 23:09:07 GMT

It of course depends on you other rules, but something like this would allow SNMP inbound, but block all other traffic:

Policies->Security

Name="Allow SMTP in to mailserver", SrcZone=WAN, SrcAddr=any, DstZone=DMZ, DstAddr=mailserver, Application=SMTP,SMTP_AUTH, Service=any Action=Allow
Name="Block all ElSalvador traffic inbound", SrcZone=WAN, SrcAddr=Regions:SV, DstZone=any, DstAddr=any, Application=any, Service=any Action=Drop

If you also want to block requests outbound to that country:

3. Name="Block all traffic outbound to El Salvador", SrcZone=LAN, SrcAddr=any, DstZone=WAN, DstAddr=Regions:SV, Application=any, Service=any Action=Drop