RadiSys SEG-100, Administration Manual

Page: 98 / 198

6
Firewall
98
Creating a Deny All IP rule
By default, traffic that does not match any rule in the IP rule set is dropped by the SEG. For
logging purposes, it is nevertheless recommended that you create an explicit IP rule with an
action of Deny for all source/destination networks/interfaces, with logging enabled, and place
it as the last rule in the IP rule set. This is often referred to as a Deny all rule.
Example: Adding a Deny All IP rule
This example shows how to create a Deny All rule that explicitly drops any IPv4 or IPv6 traffic
not caught by any preceding rules in the main IP rule set.
First, change the current context to be the main IP rule set:
Device:/> cc IPRuleSet main
Now, create the IP rule:
Device:/IPRuleSet/main> add IPRule Action=Deny Service=all_services

SourceInterface=any SourceNetwork=all ‐ nets

DestinationInterface=any

DestinationNetwork=all ‐ nets

Name=main_da
After the rule is added to an empty rule set, the entire rule set can be displayed:
Device:/IPRuleSet/main> show
IPRule, IPRuleFolder/
# Name Action SrcIf SrcNet DestIf DestNet Service
‐ ‐‐‐‐‐‐‐ ‐‐‐‐‐‐ ‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐
+ 1 main_da Deny any all ‐ nets any all ‐ nets all_services
The individual rule's properties can be displayed by using its index number:
Device:/IPRuleSet/main> show 1
Property Value
‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐
Index: 1
Name: main_da
SourceInterface: any
DestinationInterface: any
SourceNetwork: all ‐ nets
DestinationNetwork: all ‐ nets
Service: all_services
Action: Deny
LogEnabled: Yes
Comments: <empty>