6
Firewall
108
Custom access rules are optional
For
most
configurations,
the
Default
Access
Rule
is
sufficient
and
you
do
not
need
to
explicitly
specify
other
rules.
For
example,
the
default
rule
can
protect
against
IP
spoofing,
which
is
described
in
the
next
section.
If
access
rules
are
explicitly
specified,
the
Default
Access
Rule
is
still
applied
if
a
new
connection
does
not
match
any
of
the
custom
access
rules.
The
recommendation
is
to
initially
configure
the
SEG
without
any
custom
access
rules
and
add
them
if
there
is
a
requirement
for
stricter
checking
on
new
connections.
IP spoofing
Traffic
that
pretends
it
comes
from
a
trusted
host
can
be
sent
by
an
attacker
to
try
and
get
past
a
gateway's
security
mechanisms.
Such
an
attack
is
commonly
known
as
spoofing
.
IP
spoofing
is
one
of
the
most
common
spoofing
attacks.
Trusted
IP
addresses
are
used
to
bypass
filtering.
The
header
of
an
IP
packet
indicating
the
source
address
of
the
packet
is
modified
by
the
attacker
to
be
a
local
host
address.
The
security
gateway
will
believe
the
packet
came
from
a
trusted
source.
Although
the
packet
source
cannot
be
responded
to
correctly,
there
is
the
potential
for
unnecessary
network
congestion
to
be
created
and
a
potential
Denial
of
Service
(DoS)
condition
could
occur.
Even
if
the
security
gateway
is
able
to
detect
a
DoS
condition,
it
is
hard
to
trace
or
stop
because
of
its
nature.
VPNs
provide
one
means
of
avoiding
spoofing,
but
where
a
VPN
is
not
an
appropriate
solution,
the
access
rules
can
provide
an
anti
‐
spoofing
capability
by
providing
an
extra
filter
for
verifying
the
source
address.
An
access
rule
can
verify
that
packets
arriving
at
a
given
interface
do
not
have
a
source
address
that
is
associated
with
a
network
of
another
interface.
This
means:
•
Any
incoming
traffic
with
a
source
IP
address
belonging
to
a
local
trusted
host
is
NOT
allowed.
•
Any
outgoing
traffic
with
a
source
IP
address
belonging
to
an
outside
untrusted
network
is
NOT
allowed.
The
first
point
prevents
an
outsider
from
using
a
local
host's
address
as
its
source
address.
The
second
point
prevents
any
local
host
from
launching
the
spoof.
Access rule settings
The
configuration
of
an
access
rule
is
similar
to
other
types
of
rules.
It
contains
filtering
fields
as
well
as
the
action
to
take.
If
there
is
a
match,
the
rule
is
triggered,
and
the
SEG
will
carry
out
the
specified
action.
Access rule filtering fields
The
access
rule
filtering
fields
used
to
trigger
a
rule
are:
•
Interface
:
The
interface
that
the
packet
arrives
on.
•
Network
:
The
IP
span
that
the
sender
address
should
belong
to.
