IEF-G9010 Series User Manual
65
Policy Enforcement
Policy enforcement allows you to define custom protocol rules that match to an industrial protocol and will
subsequently allow or deny traffic matching these protocol rules.
Configuring Policy Enforcement
Steps:
1.
Go to [Security] > [Policy Enforcement].
The [Policy Enforcement General Setting] screen will appear.
2.
Use the toggle to enable or disable the Policy Enforcement feature.
3.
Select the operation mode if the feature is enabled:
a.
Monitor Mode
: The IEF-G9010 detects and logs abnormal protocol access to OT assets but does
not block network attacks.
b.
Prevention Mode
: The IEF G-9010 detects, blocks, and logs abnormal access to OT assets.
4.
Using the [Policy Enforcement Default Rule Action] radio buttons, select a default action for when no
pattern is matched.
The following table summarizes the settings:
Mode
(Policy Enforcement)
Action Performed
Monitor Mode
•
Detect and monitor abnormal protocol access to OT assets, without blocking
network attacks.
•
Generate logs.
Prevention Mode
•
Block abnormal protocol access to OT assets.
•
Generate logs.
Adding Policy Enforcement Rules (For Gateway Mode Only)
Note
Before creating policy enforcement rules, make sure the required objects and profiles are created.
•
IP object profiles
Configuring IP Object Profiles
•
Service object profiles
Configuring Service Object Profiles
•
Protocol filter profiles
Configuring Protocol Filter Profiles
Steps:
1.
Go to [Security] > [Policy Enforcement].
The [Policy Enforcement Rule List] screen will appear.
