topic Untrust to Untrust in General Topics

Untrust to Untrust

raji_toor — Wed, 01 Nov 2017 15:46:47 GMT

Should the untrust to untrust be denied. As the defalt interzone traffic allows everything.

untrust to untrust rules for us are ether used for IPSEC or global protect. It seems to me blocking this traffic effects detecting SCANS.

Re: Untrust to Untrust

BPry — Wed, 01 Nov 2017 17:41:23 GMT

@raji_toor,

I've always added a explicit deny rule into the configuration for untrust to untrust traffic, and then allowed the traffic if/when needed.

Re: Untrust to Untrust

BenLassila — Sat, 04 Nov 2017 18:05:24 GMT

You mean intrazone-default, not interzone-default 😉

It's a good idea to create a more specific drop rule or at least override the non-logging Default Rules, because setting logging options can be extremely useful to see what's going on.