policy, objects and smtp

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

policy, objects and smtp

L1 Bithead

howdy,

I can not get my head around how to do this.

Allow smtp from a country but block every other service, application.

You can negate countries but not services/applications.

can one do any/any with an exception?

Thank you

Certified Languages
3 REPLIES 3

L6 Presenter

Your question is a bit open ended... Do you want to block everything but SMTP from a specific country? Or block all traffic to anywhere, except for SMTP from a specific country? Generally you are going to want to try and build rules with specific allows, followed by global drops for anything else.

Allow smtp from 1 specific country but block every other service, application from that 1 specific country.

Certified Languages

L6 Presenter

It of course depends on you other rules, but something like this would allow SNMP inbound, but block all other traffic:

Policies->Security

  1. Name="Allow SMTP in to mailserver", SrcZone=WAN, SrcAddr=any, DstZone=DMZ, DstAddr=mailserver, Application=SMTP,SMTP_AUTH, Service=any Action=Allow
  2. Name="Block all ElSalvador traffic inbound", SrcZone=WAN, SrcAddr=Regions:SV, DstZone=any, DstAddr=any, Application=any, Service=any Action=Drop

If you also want to block requests outbound to that country:

3. Name="Block all traffic outbound to El Salvador", SrcZone=LAN, SrcAddr=any, DstZone=WAN, DstAddr=Regions:SV, Application=any, Service=any Action=Drop

  • 2005 Views
  • 3 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!