Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Mike_Jensen
Advisor
Jump to solution

Implied Rules vs manually created policy rules

Hello,

 

I am confused with the below scenario.

I am able to ping mailserver.mycompany.com from the public internet and I need to drop this traffic.  Logs show this traffic is accepted via implied rule.

In global properties I have Accept ICMP requests checked and it is set to Before Last.  I think this is what allows the pings with a implied rule?

If I create a test rule near the top of my policy with the source being my public internet ip, destination ip address for mailserver.mycompany.com, action drop the pings are dropped by that rule as expected.

My policy has a cleanup rule at the bottom.  I don't understand why the icmp request / ping traffic is not dropped by the cleanup rule but is dropped by my test rule?

With the global property set at "Before last" does that literally mean that the implied rule is applied before the last rule (my cleanup rule) in the policy?

What is the best practice when it comes to dropping unwanted traffic like this?

1 Solution

Accepted Solutions
_Val_
Admin
Admin

I think you just answered all your questions yourself. Yes, implied rule "before last" literally means, before the last explicit rule, which is usually the cleanup policy rule. ICMP "Before Last" is disabled by default. In your case, you can just un-check it and install policy. If you need ICMP to run, I would recommend more targeted explicit rules for that.

View solution in original post

1 Reply
_Val_
Admin
Admin

I think you just answered all your questions yourself. Yes, implied rule "before last" literally means, before the last explicit rule, which is usually the cleanup policy rule. ICMP "Before Last" is disabled by default. In your case, you can just un-check it and install policy. If you need ICMP to run, I would recommend more targeted explicit rules for that.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events