When does custom rules written in user.def gets executed?

[Blason_R]

Hi Team,

Can someone please confirm the custom rules written in user.def gets executed fore implied_rules.def and after the Policy? or before everything else?

TIA

Blason R

[G_W_Albrecht]

The FWM process converts all rules and database information including the user.def for each GW before fw_loader performs code generation, compilation and sends it to each GW, see sk101226: Policy installation flow

I would not think of before or after, as information from several sources is combined and verified for the policy per GW.

[PhoneBoy]

.def files are used, along with your defined security policy, to determine what the gateway will ultimately enforce.
In practice, they are similar to .h files when compiling C/C++ code.
The supported changes to .def files (documented in SK) typically modify existing behaviors versus adding new access rules.
It is possible to write access rules in INSPECT but this is not officially supported.

[the_rock]

I talked to someone from R&D ages ago and thats what they told me, implied rules always first and user.def after the policy, but I had never seen an official answer/statement about it, so cant say 100%, but that would make sense to me.

[Blason_R]

Well I think - Yes there has to be a sequence hence wondering whats that sequence is. And how do I alter implied rules or if I want to write my own rules like allowing certain connections through firewall without adding a policy.

[G_W_Albrecht]

When the code is prepared for compilation by FWM, the .def files come in (kind of pre-compilation code). As stated above, some existing behaviour can be altered  only by changing .def files, but Dashboard rules are much, much better as .def might get overwritten by upgrades.

[PhoneBoy]

.def files aren’t the place to make actual rules.
Creating your own rules outside of SmartConsole is generally not supported.

[the_rock]

I agree with @G_W_Albrecht . Those files will most likely get overwritten when upgrading. Personally, I would try get an official statement from TAC/ R &D.