topic Re: Universal policy Implicit Deny blocking Intrazone Traffic in General Topics

Universal policy Implicit Deny blocking Intrazone Traffic

gpsriram — Sat, 09 Mar 2019 08:44:25 GMT

Hi All,

I configured the implicit deny (Universal Policy) policy at the bottom of security policies but after that, I could see that some of the Intrazone access got denied by the implicitly deny policy.

How we can achieve the Implicit deny policy without affecting the intrazone connections ??

Thanks in Advance...

Re: Universal policy Implicit Deny blocking Intrazone Traffic

BPry — Sun, 10 Mar 2019 04:18:01 GMT

@gpsriram,

By implicit Deny are you simply saying that you made essentially an 'any any' deny policy to capture any traffic that doesn't have a security policy?

Assuming that you are and that you are relying on your default intrazone policy to allow all of the traffic, the above policy isn't what you would want to do. You need to build out security entries for the intrazone traffic or make broad intrzone traffic allow policies above your implicit deny policy. I would personally recommend that you take the time to build out proper individual security entires to allow the traffic.

Re: Universal policy Implicit Deny blocking Intrazone Traffic

jeremy.larsen — Fri, 22 Mar 2019 20:32:17 GMT

Universal includes both interzone and intrazone. If you have a universal deny policy, the behaviour you are seeing is operating as expected. Change the rule to interzone instead of universal and it should operate as you are expecting.