Policies - Security - Rule shadowed by 2nd rule

robert_smith — Tue, 13 Nov 2012 15:49:39 GMT

Much like an access list on a cisco router top to bottom. I recently created 2 rules for our 3rd party ISP to connect internet sticks via our firewall.

1st rule - Allow all traffic via TELUS internet sticks from Trust Vpn, Source (telus), Destination (Any), Actions (Allow), No profile type.

2nd rule - Deny all traffic via TELUS internet sticks from Trust Vpn, Source (telus), Destination (Any), Actions (Deny) Profiles Type "Profile", URL Filtering (VPN use only) which has allowed sites and blocked sites that I created.

However, when I commit the rules, I get an message "Security Policy: Rule Telus Internet Allowed urls" shadows rule "Telus Internet disallowed urls".

I'm not certain which to change. Any ideas?

Rob

Re: Policies - Security - Rule shadowed by 2nd rule

mikand — Wed, 14 Nov 2012 09:02:17 GMT

What about this?

srczone: Trust VPN

srcip: telus

dstzone: any

dstip: any

profile: URL Filtering (VPN use only)

options: log on session end

action: allow

srczone: any

srcip: any

dstzone: any

dstip: any

profile: none

options: log on session end

action: deny

The thing is that your "allow" (which you see in the security policy) is based on ip header while url filtering profile takes care of what you will allow/block based on url.

However, if I recall correctly, another method is to only have allowed urls in your URL filter profile and let the default deny in the bottom take care of the blocking.

Like so:

srczone: Trust VPN

srcip: telus

dstzone: any

dstip: any

profile: URL Filtering (Allowed for VPN)

options: log on session end

action: allow

srczone: any

srcip: any

dstzone: any

dstip: any

profile: none

options: log on session end

action: deny

topic Policies - Security - Rule shadowed by 2nd rule in General Topics

Policies - Security - Rule shadowed by 2nd rule

Re: Policies - Security - Rule shadowed by 2nd rule