Policy Overview
47
Policy Settings
A policy setting is similar to a rule in that it implies a specific criterion and a subsequent
action. The following policy settings can be specified for each policy:
Rules
A rule consists of various parameters that determine the characteristics for which incoming
and outgoing packets are screened, and specifies what action to take if a match occurs.
Actions may include the allowance or denial of packet transmission, and generation of an
audit packet. Each rule also includes a description field. The description field allows you to
summarize the rule or include comments that assist in the configuration of the rule. It has
no impact on policy enforcement and is an optional field.
You can group commonly used combinations of rules into
rule sets
. A rule set allows you
to insert multiple rules into an ACL as a single entry, instead of having to add each rule
separately each time you create a new policy. A rule set, when added to a policy, appears
as a single line in the ACL, even though there may be a number of rules included in the
set. A rule set can be expanded, if desired, to view the individual rules contained in that
rule set. A rule set is included in the ACL by reference only, which means the contents of
the rule set, when modified by you, are updated automatically into all policies that use
that rule set. That way you don’t have to update the rule set manually for each policy that
is currently using it.
For example, if you create a rule set that contains five rules, add it to 10 different policies,
and later decide to modify one or more of the rules contained in that set, you only need to
modify the rule set once, and not for each policy.
The system automatically places a
default rule
at the end of the ACL. The default rule
determines what action to take if none of the rule criteria in the ACL matched the packet.
You cannot disable the default rule or set it to apply only to specific protocols. The default
rule must be set either to allow or deny everything. You can, however, set the default rule
to audit.
EFW comes with a variety of pre-defined rule sets you can use to build your policies. For a
list of pre-defined rule sets, see “Pre-Defined Rule Sets” on page 67.
Policy Setting
Select this Policy Setting to
No Sniffing
Ensure that the NIC does not sniff packets addressed to other
NICs.
No Spoofing, No Routing
Ensure that the NIC does not spoof packets to appear as if they
were sent by other NICs. For a packet to be allowed, its source IP
Address must be one of the IP addresses bound by the operating
system to this NIC.
NOTE:
This policy does not prevent manually changing the IP address of a machine and rebooting to
attempt to masquerade as a different machine. To prevent this, use the static IP address option
discussed on page 30 under “Registering EFW NICs Manually.”
Allow Non-IP Traffic
Allow protocols other than IP.
Allow Fragmented IP Packets
Allow fragmented IP packets.
Allow IP Options
Allow packets with IP options. These packets are typically used for
network testing and debugging.
