Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Antonis_Hassiot
Contributor

Inline layer for web traffic

Hi there,

I wanted to start using inline layers. 

I am trying to the think how I would edit my user->internet web traffic as this would be the heaviest rule in the rulebase.

I have AC/URL, CA, ThreatPrevention (AV, AB and IPS) and HTTPs inspection blades on R80.30.

I currently have several rules that apply to all my users in AC/URLF and TP. 

Would I create an inline layer with Firewall enabled and then sub-layers for each of the blades above? Should I go just one deep when creating these layers or layers within layers? Most of my rules apply to all users. 

I created a Content Awareness layer in my rulebase to test and although it works ok, when I try to add extra rules with source/destination Any (parent rule has all my user networks as source) the policy installation throws an error as it doesn't like Any in the source or destination on more than one rules in the layer.

Moreover, I noted that the packets are inspected by my ordered layers irrespective of the fact that I have a catch all rule in the inline layer. Is this expected?

 A.

 

 

0 Kudos
4 Replies
PhoneBoy
Admin
Admin

If you have multiple ordered layers, traffic must hit an accept rule in each ordered layer to pass.
If traffic matches a parent rule for an inline layer, the traffic must match a rule in the inline layer to pass (in addition to other ordered layers).
Inline layers have their own “implicit allow/block” setting.

You can nest inline layers in inline layers, though  I believe there are issues going more than a few layers deep and/or using too many layers in a policy.

Antonis_Hassiot
Contributor

Thanks. What about source and destination being Any in the child rules? For instance I want my user traffic to go through the AC/URLF blade, so I create an AC inline layer with multiple rules. Can I have source and destination Any for these rules, or is this not meant to be? Am I supposed to do this a different way?

0 Kudos
Maik
Advisor

Try to use the "Internet" object as the destination for Application Control & URL Filtering rules.

More best practices and generel advices can be obtained from here. 

PhoneBoy
Admin
Admin

Source Any Destination Any rules tend to be used for cleanup rules (at the end).
You should be using "Internet" as the Destination unless these are custom resources for internal sites where "any" shouldn't be used either.