6
Firewall
99
Now,
return
to
the
default
root
context:
Device:/IPRuleSet/main>
cc
Device:/>
Save
the
configuration
changes
by
issuing
the
activate
command
followed
by
the
commit
command.
Tip:
There
may
be
several
IP
rule
sets
in
use.
It
is
recommended
to
include
the
IP
rule
set
name
in
the
name
of
the
deny
all
rule
so
it
can
be
easily
identified
in
log
messages.
In
the
above
example,
the
deny
all
rule
for
the
main
rule
set
is
given
the
name
main_da
.
Traffic flow needs an IP rule and a route
As
stated
above,
when
the
SEG
is
started
for
the
first
time,
the
default
IP
rules
deny
all
traffic
so
at
least
one
IP
rule
must
be
added
to
allow
traffic
to
flow.
In
fact,
a
number
of
conditions
need
to
be
satisfied:
•
A
route
must
exist
in
an
SEG
routing
table
that
specifies
on
which
interface
packets
should
leave
in
order
to
reach
their
destination.
A
second
route
must
also
exist
that
indicates
the
source
of
the
traffic
is
found
on
the
interface
where
the
packets
enter.
This
satisfies
the
reverse
route
lookup
check
performed
by
the
SEG
when
a
new
flow
is
established.
•
An
IP
rule
in
an
SEG
IP
rule
set
that
specifies
the
security
policy
that
allows
the
packets
from
the
source
interface
and
network
bound
for
the
destination
network
to
leave
the
SEG
on
the
interface
decided
by
the
route.
If
the
IP
rule
used
is
an
Allow
rule,
it
is
bi
‐
directional
by
default.
The
ordering
of
these
steps
is
important.
The
route
lookup
occurs
first
to
determine
the
exiting
interface
and
then
the
SEG
looks
for
an
IP
rule
that
allows
the
traffic
to
leave
on
that
interface.
If
a
rule
allowing
the
traffic
doesn’t
exist,
the
traffic
is
dropped.
Figure 7. Simplified
SEG
traffic flow
