Security Policy - US access only

[YParreno]

Hello,

I'm trying to configure a Security Policy to only allow US-region IP addresses to hit our network.   I added as a first rule to allow any untrust us region to destination untrust US region.  I am not sure if this is correct.  maybe I'm allowing all traffic within US, that probably is not supposed to be allowed.  

thanks

#urlfiltering #regionfiltering

[SCantwell_IM]

How about:

first rule to allow any untrust us region to destination untrust US region, with destination of your public IP of your FW?

You did not mention/relay that you have any destination NAT rules, so I presume there are none., so no outside US traffic will hit the inside of your network.  Is this correct?

[BPry · Accepted solution]

@YParreno,

I wouldn't set this rule up like this. Instead, I would setup an entry that lists US as the source with the negate-source option enabled and set the application and service to any and the action to deny. This will drop any and all traffic that doesn't originate from the US, while allowing the rest of your rulebase to actually handle traffic.

As you've presently configured things as you've described, you're allowing all traffic from the US to hit your untrust zone, which you likely don't want to do. 

[YParreno]

thank you, that is exactly what i did.