topic Re: Security Policy - US access only in General Topics

Security Policy - US access only

YParreno — Wed, 09 Mar 2022 13:07:56 GMT

Hello,

I'm trying to configure a Security Policy to only allow US-region IP addresses to hit our network. I added as a first rule to allow any untrust us region to destination untrust US region. I am not sure if this is correct. maybe I'm allowing all traffic within US, that probably is not supposed to be allowed.

thanks

#urlfiltering #regionfiltering

Re: Security Policy - US access only

S.Cantwell — Tue, 29 Mar 2022 00:34:02 GMT

How about:

first rule to allow any untrust us region to destination untrust US region, with destination of your public IP of your FW?

You did not mention/relay that you have any destination NAT rules, so I presume there are none., so no outside US traffic will hit the inside of your network. Is this correct?

Re: Security Policy - US access only

BPry — Tue, 29 Mar 2022 16:50:16 GMT

@YParreno,

I wouldn't set this rule up like this. Instead, I would setup an entry that lists US as the source with the negate-source option enabled and set the application and service to any and the action to deny. This will drop any and all traffic that doesn't originate from the US, while allowing the rest of your rulebase to actually handle traffic.

As you've presently configured things as you've described, you're allowing all traffic from the US to hit your untrust zone, which you likely don't want to do.

Re: Security Policy - US access only

YParreno — Tue, 26 Jul 2022 19:58:33 GMT

thank you, that is exactly what i did.