Clavister NetWall 100 Series, Руководство по началу работы

Страница: 56 / 81

As with previous policy definitions, NAT should also be enabled if the protected local hosts have
private IPv4 addresses. The ICMP messages will then be sent out from the firewall with the IP
address of the interface connected to the ISP as the source. Responding hosts will send back
ICMP responses to this address and cOS Core will then forward the traffic to the correct private
IPv4 address.
Adding a "Drop All" Policy is Recommended
Scanning of IP rule sets is done in a top-down fashion. If no matching rule set entry is found for
traffic then a hidden, implicit
default rule is triggered. This rule cannot be changed and its action
is to drop all such traffic as well as generate a log message when it is triggered.
In order to gain more control over dropped traffic and its logging, it is recommended to create
an explicit "drop all" IP policy as the last entry in the
main IP rule set. This policy has both the
source and destination network set to all-nets and both the source and destination interface set
to any . The service would be set to all_services in order to trigger on all traffic types, as shown in
the example below.
Logging is enabled by default for an IP rule set entry which means that a log message will be
sent to all configured log servers whenever the entry triggers. Only log events that have a
specified severity or above will be sent. The administrator can choose the minimum severity for
log messages in each IP rule set entry, as shown below.
Chapter 4: cOS Core Configuration
56