Deny Multiple Services in a Single Rule

[RemoteUser]

Hi Mates,

I’d like to ask if it’s possible to deny more than one service within a single rule. (Negated cell)
For example, let’s say I want to allow all traffic except ICMP and HTTPS — can this be configured in one rule, or do I need to create separate rules for each service I want to block?

Thanks in advance!

[PhoneBoy · Accepted solution]

In Access Control rules, yes.
Don't believe the NAT policy permits this, however.

[the_rock · Accepted solution]

Hey brother,

I verified what Phoneboy said and it is 100% true. You can easily do this with regular access control policy, but nat does NOT allow you, it always defaults to last service added.

[RemoteUser]

Thanks a lot to both!!! As Always!!!

[the_rock]

FYFOC...aka for you, free of charge 😉

[Tal_Paz-Fridman]

If you have a large rulebase, I recommend using a Services Group with clearly defined properties. This helps keep the rulebase cleaner and also allows you to make a single-click change that applies to all rules using the same Services Group.

[the_rock]

I also recommend deleting anything unused in object explorer...based on my testing, I found it to be 100% accurate.