6
Firewall
102
When
an
IP
rule
is
triggered
by
a
match,
one
of
the
following
Actions
can
occur:
•
Allow:
The
packet
is
allowed
to
pass
from
the
specified
source
to
the
specified
destination
interface.
As
the
rule
is
applied
to
only
the
opening
of
a
flow,
an
entry
in
the
“flow
table”
is
made
to
record
that
a
flow
is
open.
The
remaining
packets
related
to
this
flow
will
pass
through
the
SEG
“stateful
engine”
and
will
not
require
another
rule
table
lookup.
The
parameter
SourceTranslation
can
optionally
be
set
to
one
of
the
following
values:
•
NAT
:
This
enables
dynamic
address
translation
(NAT)
for
traffic
that
triggers
the
rule.
Refer
to
SAT
on
page
78
for
a
detailed
description.
•
SAT
:
This
enables
static
address
translation
(SAT)
for
traffic
that
triggers
the
rule.
Refer
to
SAT
on
page
78
for
a
detailed
description.
•
Deny:
This
tells
the
SEG
to
immediately
discard
the
packet
and
by
default,
no
reply
is
sent
back
to
the
sending
host.
A
“polite”
version
of
Deny
can
be
created
if
the
optional
OnDeny
parameter
of
a
Deny
rule
is
set
to
SendReject
.
This
setting
means
the
rule
returns
a
TCP
RST
or
ICMP
Unreachable
message
for
denied
traffic,
informing
the
sender
that
the
packet
was
dropped.
Using
this
option
can
help
to
speed
up
applications
that
must
wait
for
a
reply
timeout
period.
The
“impolite”
default
setting
for
a
Deny
rule
is
OnDeny=DropSilent
.
Bi-directional connections
A
common
mistake
when
setting
up
IP
Rules
is
to
define
two
rules,
one
rule
for
traffic
in
one
direction
and
another
rule
for
traffic
coming
back
in
the
other
direction.
In
fact,
an
IP
rules
with
the
action
defined
as
Allow
will
permit
bi
‐
directional
traffic
flow
once
the
initial
flow
is
set
up.
The
SourceNetwork
and
SourceInterface
in
an
IP
rule
with
action
Allow
refers
to
the
source
of
the
initial
flow
request.
If
a
flow
is
permitted
and
then
becomes
established,
traffic
can
pass
in
either
direction
over
it.
Using Reject
The
Reject
action
is
recommended
instead
of
Drop
in
situations
where
a
“polite”
reply
is
required
from
the
SEG.
An
example
of
such
a
situation
is
when
the
SEG
is
responding
to
the
IDENT
user
identification
protocol.
Some
applications
will
pause
for
a
timeout
if
Drop
is
used,
and
using
Reject
can
avoid
such
processing
delays.
