topic Re: Policy Related Question in Firewall and Security Management

Policy Related Question

Vijay_Nagaraj — Fri, 22 Feb 2019 16:26:17 GMT

Hi All,

Am working on rule base cleanup and after i cleaned up few rules i see some hits in my old rules for any service..below is the example . We have R77.30 Mgmt server.

we have created the new rules on top of old rule, now when I checked the usage of old rules only for service I still see the usage in the old rules for the same ports which is allowed on new rules. Please let me know if this is fine to disable the old rules?

For example : Rule 101 (Old) ANY Service

Rule 102 (New) FTP, HTTP

But still seeing hits in old rules for same services.

Vijay

Re: Policy Related Question

Vijay_Nagaraj — Fri, 22 Feb 2019 16:33:41 GMT

HI the rule order is New rule with limited service on top and same source and destination with ANY service in bottom.

Vijay

Re: Policy Related Question

Mark_Mitchell — Fri, 22 Feb 2019 19:28:07 GMT

Hi Vijay,

If your more specific rule is placed above the less specific one, then the more specific rule should be being hit. Can you share more details around the rules please? And also the log entries if possible?

If your "new" rule is not being hit right now then disabling the old rule will more than likely result in a loss of service.

Regards

Mark

Re: Policy Related Question

Vijay_Nagaraj — Fri, 22 Feb 2019 20:50:49 GMT

Hi,

My new rule with limited services like HTTP, STP is in top

My old rule with ANY services is bottom of this rule. Both has the same source and destination but the service differs.

VIjay

Re: Policy Related Question

Mark_Mitchell — Fri, 22 Feb 2019 20:56:51 GMT

Hi Vijay,

I understand your rule ordering. However your problem is that your traffic isn't matching your new rule.

To help you diagnose this we need to see log entries to see what is happening in the environment.

Please post further information so that we can help you.

Regards

Mark

Re: Policy Related Question

JozkoMrkvicka — Sat, 23 Feb 2019 08:10:08 GMT

Did you push the policy on affected firewall ?

Re: Policy Related Question

Vijay_Nagaraj — Sat, 23 Feb 2019 13:30:21 GMT

Yes,,,