RFC1918

[s.williams1]

Basic trust to untrust policy I see internal address sending snmp to addresses like 10.0.0.1, 192.168.1.x.

Do people create a policy to block internal traffic going to RFC1918 on the untrusted interface?

[Raido_Rattameister]

I usually block trust to untrust RFC1918.

Although ISP routers drop it anyway I like to keep it clean.

It is really common for many applications like Skype for example to scan internal ranges for peers.

[JimDeMayo]

Do you have the one line policy.

Trust to untrust  ( the builtin PAN addresses appear confusing.

TrRUST or INSIDE zones

ANY

UNTRUST  

• 10.0.0.0 – 10.255.255.255  (10/8 prefix)
• 172.16.0.0 – 172.31.255.255  (172.16/12 prefix)
• 192.168.0.0 – 192.168.255.255 (192.168/16 prefix)

Action Block/deny

This is  the first policy I believe

[OtakarKlier]

Hello,

If you follow a DENY ALL allow by exception methodology, just put a DENY ALL policy at the bottom of the Security Policies. This way only traffic that you 'allow' is allowed to go between zones, etc.

Regards,