topic Re: RFC1918 in General Topics

RFC1918

s.williams1 — Tue, 19 Sep 2017 20:28:00 GMT

Basic trust to untrust policy I see internal address sending snmp to addresses like 10.0.0.1, 192.168.1.x.

Do people create a policy to block internal traffic going to RFC1918 on the untrusted interface?

Re: RFC1918

Raido_Rattameister — Tue, 19 Sep 2017 20:52:10 GMT

I usually block trust to untrust RFC1918.

Although ISP routers drop it anyway I like to keep it clean.

It is really common for many applications like Skype for example to scan internal ranges for peers.

Re: RFC1918

JimDeMayo — Thu, 15 Dec 2022 22:11:19 GMT

Do you have the one line policy.

Trust to untrust ( the builtin PAN addresses appear confusing.

TrRUST or INSIDE zones

ANY

UNTRUST

10.0.0.0 – 10.255.255.255 (10/8 prefix)
172.16.0.0 – 172.31.255.255 (172.16/12 prefix)
192.168.0.0 – 192.168.255.255 (192.168/16 prefix)

Action Block/deny

This is the first policy I believe

Re: RFC1918

OtakarKlier — Thu, 22 Dec 2022 19:52:12 GMT

Hello,

If you follow a DENY ALL allow by exception methodology, just put a DENY ALL policy at the bottom of the Security Policies. This way only traffic that you 'allow' is allowed to go between zones, etc.

Regards,