topic Re: block interne in General Topics

block interne

Satish — Mon, 30 Jun 2014 10:50:15 GMT

Hi friends,

How to block internet on our DB servers.

Regards

Satish

Re: block interne

pulukas — Mon, 30 Jun 2014 12:18:44 GMT

You would create an address group that contains all of the db servers.

then create a deny policy from this group to your internet zone as a block. Use log on session initiation to see what hits this rule.

Re: block interne

mivaldi — Tue, 01 Jul 2014 00:54:54 GMT

Another alternative is to open your Source NAT policy that broadly enables your network to gain internet access, and add the IP Addresses (or the Address Group as Steven Puluka suggested) to the Source Address group. You then check the box underneath that indicates "Negate". This will say: - "Do a Source NAT to enable internal network to gain internet access "except" if the source address is with these source addresses".

The Security Policy alternative mentioned by Steven is a better practice, and it will write access attempts to the traffic logs.

Re: block interne

hshah — Tue, 01 Jul 2014 01:22:42 GMT

Hi satish,

By default In-coming Internet traffic is blocked for any Host behind the firewall. You may want to find out, why its allowed.

That would be a good first troubleshooting step.

Regards,

Hardik shah

Re: block interne

Satish — Wed, 02 Jul 2014 11:30:53 GMT

Thanks Dud...