Version 3R2
Security Appliance User Guide
9-1
P
OLICY
C
ONFIGURATION
9
This chapter describes how to create and apply security policies. This
chapter includes the following topics:
•
About Security Policies
•
Configuring Policies
•
Configuring Address Objects
•
Configuring Service Objects
•
Configuring Service Groups
•
About Schedules
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A B O U T S E C U R I T Y P O L I C I E S
A policy allows, denies, or rejects specific traffic based on the source,
destination, and service type sent in a single direction between two end
points. The unidirectional nature of policies requires that two policies are
configured for traffic that is initiated from either side of two end points.
ABOUT TRAFFIC FLOW AMONG POLICIES
The default behavior of the appliance is to deny traffic from one zone to
another. To permit communication from one zone to another, you must
configure a policy. After you use the
set policy
command to create a
policy, the policy enters the policy database and is immediately active.
The source zone, destination zone, and order of a policy within the
database are important. The freeGuard Blaze 2100 software assigns
each policy an ID number which numerically orders all policies in
ascending order. Incoming traffic is first determined to be interzone or
intrazone using the source and destination zone information. It is then
matched against policies in the database from top to bottom.
If the source and destination zones are different, then the interzone
policies are searched for a matching policy. If there is no match, then the
global policies are searched. If there is no match, a default zone policy is
applied and the packet is dropped.
