topic Re: When does custom rules written in user.def gets executed? in Firewall and Security Management

When does custom rules written in user.def gets executed?

Blason_R — Thu, 13 Oct 2022 04:32:36 GMT

Hi Team,

Can someone please confirm the custom rules written in user.def gets executed fore implied_rules.def and after the Policy? or before everything else?

TIA

Blason R

Re: When does custom rules written in user.def gets executed?

G_W_Albrecht — Thu, 13 Oct 2022 09:17:05 GMT

The FWM process converts all rules and database information including the user.def for each GW before fw_loader performs code generation, compilation and sends it to each GW, see sk101226: Policy installation flow

I would not think of before or after, as information from several sources is combined and verified for the policy per GW.

Re: When does custom rules written in user.def gets executed?

PhoneBoy — Thu, 13 Oct 2022 16:14:24 GMT

.def files are used, along with your defined security policy, to determine what the gateway will ultimately enforce.
In practice, they are similar to .h files when compiling C/C++ code.
The supported changes to .def files (documented in SK) typically modify existing behaviors versus adding new access rules.
It is possible to write access rules in INSPECT but this is not officially supported.

Re: When does custom rules written in user.def gets executed?

the_rock — Thu, 13 Oct 2022 16:59:17 GMT

I talked to someone from R&D ages ago and thats what they told me, implied rules always first and user.def after the policy, but I had never seen an official answer/statement about it, so cant say 100%, but that would make sense to me.

Re: When does custom rules written in user.def gets executed?

Blason_R — Fri, 14 Oct 2022 04:28:53 GMT

Well I think - Yes there has to be a sequence hence wondering whats that sequence is. And how do I alter implied rules or if I want to write my own rules like allowing certain connections through firewall without adding a policy.

Re: When does custom rules written in user.def gets executed?

G_W_Albrecht — Fri, 14 Oct 2022 09:35:08 GMT

When the code is prepared for compilation by FWM, the .def files come in (kind of pre-compilation code). As stated above, some existing behaviour can be altered only by changing .def files, but Dashboard rules are much, much better as .def might get overwritten by upgrades.

Re: When does custom rules written in user.def gets executed?

PhoneBoy — Fri, 14 Oct 2022 12:39:38 GMT

.def files aren’t the place to make actual rules.
Creating your own rules outside of SmartConsole is generally not supported.

Re: When does custom rules written in user.def gets executed?

the_rock — Fri, 14 Oct 2022 13:03:49 GMT

I agree with @G_W_Albrecht . Those files will most likely get overwritten when upgrading. Personally, I would try get an official statement from TAC/ R &D.