4
Managing Policies
52
Creating a Rule Set from a Policy
You can group a number of rules within a particular policy into a rule set that can then be
used again in other policies. To create a rule set, follow the steps below.
1
Click the
Policy
tab and select the policy from which you are creating the rule set.
(If you don’t have a policy window open, the Make Rule Set option is not available in
the Policy menu.)
2
In the
Policy
menu, select
Make Rule Set
or click the
Make Rule Set Wizard
icon. The Make Rule Set window appears.
3
Enter the name of the Rule Set in the Rule Set field.
The maximum number of characters that can be entered in the name field is 64. Valid
characters for a name field include all alphanumeric characters (non-case-sensitive),
underscore, hyphen, space, period, colon, parentheses, comma, and forward slash.
The system is case-insensitive and considers two names identical if they differ only
in case.
Destination Port
Matches a specific TCP or UDP application port or range of ports (for example, 20-21, etc.) used by the
destination. The default (0) matches any port.
IP Protocol
Should be TCP or UDP if a source port or destination port was specified in the previous steps. You can
also select a specific protocol from the drop-down list.
Direction
Applies to whether a packet comes into a secured computer or leaves a secured computer. It indicates
whether this rule applies to packets incoming to the device enforcing this policy, outgoing from the
secured computer enforcing this policy, or both. This determination is done by selecting
In
,
Out
, or
Both
from the drop-down list.
NOTE:
Selecting
Both
does not cause the source and destination information to be “flipped” according
to whether the packet is incoming or outgoing. Most communication is bi-directional and requires two
rules. Selecting
Both
is useful, however, if the source information and destination information are
identical.
Rule-Action Parameter
This Parameter
Action
Determines what action should be performed when a packet matches the rule-filter parameters:
■
Allow
—Passes the packet to its destination.
■
Deny
—Discards the packet.
Audit
Audits all packets that match all the rule-filter parameters.
NOTE:
Auditing the ICMP protocol is not recommended. The ICMP protocol is commonly used within
the network and creates large amounts of non-useful audit data.
Test
Places this rule in test mode. In test mode, when a packet matches the rule, the allow or deny action
specified for that rule is ignored, audit data is generated, and filtering goes on to the next rule. (If you
do not want audit data for the rule, manually de-selected the Audit parameter when the rule is in Test
mode. Since the only effect of a rule in Test mode is audit, this is essentially the same as disabling the
rule.)
Enable
Indicates this rule should be distributed to affected EFW devices when the policy is saved. This check box
is initially selected by default.
Rule-Filter Parameter
This Parameter
NOTE:
The first character in the name field must be an alphanumeric character.
