topic Re: mdps management separation and management access rule in Firewall and Security Management

mdps management separation and management access rule

Luis_Miguel_Mig — Mon, 21 Jun 2021 09:31:18 GMT

I am a fan of the mdps feature but I miss the ability to have a policy package dedicated to the management plane and separated from the data plane. Could this be a new feature in the future?

In the meanwhile, I was wondering if it would make sense to have an ordered layer just dedicated to the management rule and stealth rule.

I think it could simplify it and be more visual but I was wondering if there could be any drawback.

Re: mdps management separation and management access rule

PhoneBoy — Wed, 23 Jun 2021 14:49:39 GMT

In terms of performance, it should make no difference.
It's also an example of where Policy Layers can be useful, though I might personally use an inline layer instead.
Horses for courses, though 🙂

Re: mdps management separation and management access rule

Luis_Miguel_Mig — Thu, 24 Jun 2021 14:10:35 GMT

Even though I think it is a good idea to have a separate layer for mgmt just for clarity, just realizing that in order to work it would need to be the last order layer and it defeats the purpose because we want the mgmt rule to be matched at the begining.

I think you are right and I will leave it as an inline layer within the general data plane ordered layer

Re: mdps management separation and management access rule

PhoneBoy — Thu, 24 Jun 2021 14:39:09 GMT

If you wanted to do it with ordered layers, why couldn't it be the first one?
That first layer would just have to accept traffic not destined for the gateway.
That said, it might create some issues with logging since, when multiple ordered layers are used, I believe it shows only the rule number in the first layer in the various tables.
That suggests an inline layer is probably the better option.

Re: mdps management separation and management access rule

Luis_Miguel_Mig — Thu, 24 Jun 2021 14:55:32 GMT

It is okay for traffic not destined for the gateway.

The problem is for traffic destined for the gateway.

The mgmt rule basically accepts specific traffic to the gateway like ssh for example but if you get a hit in an ordered layer you move to the next ordered layer until you get a drop or until the get to an accept in the last ordered layer, no?

As far as I understand you can't get an accept in the first ordered layer and stop there

Re: mdps management separation and management access rule

PhoneBoy — Thu, 24 Jun 2021 15:00:54 GMT

If you use ordered layers, then the traffic must hit an accept rule in each layer, you are correct.

Re: mdps management separation and management access rule

Luis_Miguel_Mig — Fri, 25 Jun 2021 09:25:44 GMT

Going back to one of your comments. Why do we show the rule number of the first layer?
The rule that really matters is the rule hit in the last ordered layer, no? It would way more useful if it was that way.

Re: mdps management separation and management access rule

PhoneBoy — Fri, 25 Jun 2021 21:52:11 GMT

Why it does this I'm not sure, but that's the behavior I've observed.