policy, objects and smtp

[PA200-1]

howdy,

I can not get my head around how to do this.

Allow smtp from a country but block every other service, application.

You can negate countries but not services/applications.

can one do any/any with an exception?

Thank you

[Adrian_Jensen]

Your question is a bit open ended... Do you want to block everything but SMTP from a specific country? Or block all traffic to anywhere, except for SMTP from a specific country? Generally you are going to want to try and build rules with specific allows, followed by global drops for anything else.

[PA200-1]

Allow smtp from 1 specific country but block every other service, application from that 1 specific country.

[Adrian_Jensen]

It of course depends on you other rules, but something like this would allow SNMP inbound, but block all other traffic:

Policies->Security

1. Name="Allow SMTP in to mailserver", SrcZone=WAN, SrcAddr=any, DstZone=DMZ, DstAddr=mailserver, Application=SMTP,SMTP_AUTH, Service=any Action=Allow
2. Name="Block all ElSalvador traffic inbound", SrcZone=WAN, SrcAddr=Regions:SV, DstZone=any, DstAddr=any, Application=any, Service=any Action=Drop

If you also want to block requests outbound to that country:

3. Name="Block all traffic outbound to El Salvador", SrcZone=LAN, SrcAddr=any, DstZone=WAN, DstAddr=Regions:SV, Application=any, Service=any Action=Drop