topic Re: Inline Layers in Firewall and Security Management

Inline Layers

Lari_Luoma — Tue, 26 Apr 2016 16:33:27 GMT

I know that inline layers are not supported for pre-R80 gateways, but can I even create them (for testing purposes) in R80 SmartConsole? It seems that only ordered layers are supported now?

Re: Inline Layers

Tomer_Sole — Wed, 27 Apr 2016 07:40:21 GMT

Please see the topics Layers in R80 and How do I create an Access Policy for Pre-R80 GWs? for the list of the supported features.

R80 Management has the support for inline layers, however like you said, when using them for a pre-R80.10 GW, install policy will fail.

Setting an inline layer is done by clicking a rule's action and selecting the "Inline Layer" option. You can either select an existing layer (if it's marked as shared) or create a new one.

The way that inline layers work is the following: When the connection matches a parent rule that its action is an inline layer, the inline layer rules get evaluated.

Every inline layer (and also every layer) has an implicit cleanup rule that is either "any any accept" or "any any drop" set in its properties under "advanced". This means that once you go inside an inline layer, you cannot go outside back to the main layer, therefore rules in the inline layer cannot block rules that reside below the parent rule that holds them. Giving an admin the permission to only edit an inline layer will not affect the main layer that holds it.

To see the list of all layers, open the Manage Layers view from this location:

Re: Inline Layers

Mohammed_Omin_B — Thu, 21 Feb 2019 06:51:09 GMT

Query: when we add the Target gateway in the InLine layer then we need to explicitly add the same targets in the rules inside? I think we need not as the InLine says for which target the rules are also even if we add any other gateway as the target inside then it will not work (traffic will not match the Inline).

Is my understanding correct?

Thanks

Re: Inline Layers

PhoneBoy — Sun, 24 Feb 2019 02:45:05 GMT

No, that is not necessary to do.

In fact, it would be redundant to do so and make it difficult to reuse the layer on a different gateway.