topic Security Policy Granular to Address Group? in General Topics

Security Policy Granular to Address Group?

catrock — Sun, 11 Nov 2018 22:54:52 GMT

I have a group of computers that I want to apply a different security policy with a different Security Profile to.

I have created 2 Security policies.

The first policy = Internet Out allow any - Trusted Zone to Untrusted Zone with the default 'basic file blocking' Security profile.

The second policy = Internet Out allow any - Trusted Zone with Source Address = Test_Group (specific group of computers) and a 'special file blocking' Security profile.

The policies don't seem to granulary apply. Meaning, the Top policy always applies to ALL Outgoing computers.

I recently added a Negate Source in the first policy to see if it would allow the 'special group' of computers to pass over the first policy and have the second policy apply to them. This may have resolved my desired policy application results?

If not - what could I be missing?

Thanks in advance.

Re: Security Policy Granular to Address Group?

Remo — Sun, 11 Nov 2018 23:32:17 GMT

Hi @catrock

The firewall always evaluates the policies top>down. So you need to place the more granular rule (the one with the specific source addresses) above the rule with the general access for your trust zone.

Re: Security Policy Granular to Address Group?

catrock — Mon, 19 Nov 2018 14:38:24 GMT

Thank you @Remo

My policy's are as such in the attached image.

Should work as desired - yes?

Re: Security Policy Granular to Address Group?

pulukas — Thu, 22 Nov 2018 14:26:01 GMT

Yes, that seems to be correct.

What is the less strict address object?

And what does the session logs show for the unexpectedly permitted traffic in the details?

Re: Security Policy Granular to Address Group?

catrock — Fri, 07 Dec 2018 14:39:14 GMT

Hello,

The Less_Strict_Object is a member of a Less_Strict_addy_grp that will be used to allow different secuity Profle group settings.

There is only 1 computer in this group - it is define by a single IP. I did have the IP address (defined in the object) 'ip netmask using a CIDR (192.168.0.23/24). I have removed the /24 from it to test further (192.168.0.23)

Specifically, I am trying to use it to allow my mac to download VMWare fusion updates that are TAR/other that I don't want other computers to be able to download.

BTW: the policy order still doesn't seem to be working properly.