80
FWX120 Operation Manual
4
Enhancing security
Passing only necessary packets
through a dynamic filter (policy filter)
A combination of conditions and actions expressed in a manner similar to the way humans think is
called a policy. An example of the policy could be “discarding TELNET traffic that goes from LAN2
to LAN1”. A policy filter enables you to easily achieve stateful inspection filtering.
Preliminary policy set
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Minimum policy set
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
UP LINK
1
3
4
2
LAN
Provider
Policy set for emergency
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Policy set for normal operation
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Condition: TELNET communi-
cation from LAN2 to LAN1
Action: discard
Internet
DOWNLOAD
POWER
STATUS
LAN 1
LAN 2
microSD
USB
LAN2
4
3
2
1
ON
STANDB
Y
CONSO
LE
LAN1
• Specify a receiving or transmission interface, a source or destination IP address, and a service to
allow traffic to pass through or to be discarded on a connection basis, not a packet basis.
• The filter is applied as necessary while the communication status is being monitored. You can set
a filter considering the state of a session. For example, “All the data from the Internet to the LAN
is usually discarded, and return packets can pass through only when an ftp connection is initiated
from the LAN”.
• Up to three sets of policy lists (policy sets) can be created. You can first create one policy set for
use in normal operation and another for emergency situations that can allow only minimum required
connections. These policy sets are useful in cases when you want to change policies quickly enough
to suit your situati
o
n.
Tip
•
You can also create a group of interfaces, addresses, and services to which you want to apply the same
policy (page 85). For example, you can create a “WAN” group and add “LAN2, PP1, and TUNNEL1”
interfaces to that group. Specifying this “WAN” group as an interface on creation of a policy filter can save
time and effort to create the policy filter for each of LAN2, PP1, and TUNNEL1 interfaces.
• Basically, a service conceptually refers to an application, which includes TELNET, SMTP, POP, FTP, and
WWW. In addition, you can specify a protocol and port to define a given service (user definition service).
This service is available in policy filters that you create (page 87).
• Another applicable access management example can be: You apply a policy filter to a group of IP addresses
for registered terminals (page 91). You can then allow only part of the registered terminals to access
specific networks (such as an internal network with a higher security level).
