6
Firewall
107
Service groups
A
service
group
is
an
SEG
object
that
consists
of
a
collection
of
services.
Groups
are
useful
when
you
want
to
construct
security
policies
that
contain
multiple
services.
Advantage of groups
For
example,
there
may
be
a
need
for
a
set
of
IP
rules
that
are
identical
to
each
other
except
for
the
service
property.
By
defining
a
service
group
that
contains
all
the
service
objects
from
all
the
individual
rules,
you
can
replace
all
of
them
with
just
one
IP
rule
that
uses
the
group.
For
example,
a
service
group
called
‐
services
combines
the
three
services
objects
for
SMTP
,
POP3,
and
IMAP
.
Now
only
one
IP
rule
needs
to
be
defined
that
uses
this
group
service
to
allow
all
e
‐
related
traffic
to
flow.
Groups can contain other groups
A
group
can
contain
individual
services
as
well
as
other
service
groups.
This
ability
to
have
groups
within
groups
should
be
used
with
caution
since
it
can
increase
the
complexity
of
a
configuration
and
decrease
the
ability
to
troubleshoot
problems.
However,
the
feature
allows
the
easy
construction
of
large
and
complex
sets
of
service
definitions.
Access rules
One
of
the
principal
functions
of
the
SEG
is
to
allow
only
authorized
connections
access
to
protected
data
resources.
Access
control
is
primarily
addressed
by
the
SEG
IP
rule
set
in
which
a
range
of
protected
LAN
addresses
are
treated
as
trusted
hosts,
and
traffic
flow
from
untrusted
sources
is
restricted
from
entering
trusted
areas.
Before
a
new
connection
is
checked
against
the
IP
rule
set,
the
SEG
checks
the
connection
source
against
a
set
of
access
rules
.
Access
rules
can
be
used
to
specify
what
traffic
source
is
expected
on
a
given
interface
and
also
to
automatically
drop
traffic
originating
from
specific
sources.
Access
rules
provide
an
efficient
and
targeted
initial
filter
of
new
connection
attempts.
Default access rule
Even
if
you
do
not
explicitly
specify
any
custom
access
rules,
an
access
rule
known
as
the
Default
Access
Rule
is
always
in
place.
This
default
rule
is
not
a
true
rule
but
operates
by
checking
the
validity
of
incoming
traffic
by
performing
a
reverse
lookup
in
the
SEG
routing
tables.
This
lookup
validates
that
the
incoming
traffic
is
coming
from
a
source
that
the
routing
tables
indicate
is
accessible
via
the
interface
on
which
the
traffic
arrived.
If
this
reverse
lookup
fails,
the
connection
is
dropped
and
a
Default
Access
Rule
log
message
will
be
generated.
When
troubleshooting
dropped
connections,
you
should
look
for
Default
Access
Rule
messages
in
the
logs.
The
solution
to
the
problem
is
to
create
a
route
for
the
interface
where
the
connection
arrives
so
that
the
route's
destination
network
is
the
same
as
or
contains
the
incoming
connection's
source
IP.
