mdps management separation and management access rule

[Luis_Miguel_Mig]

I am a fan of the mdps feature but I miss the ability to have a policy package dedicated to the management plane and separated from the data plane. Could this be a new feature in the future?

In the meanwhile, I was wondering if it would make sense to have an ordered layer just dedicated to the management rule and stealth rule.

I think it could simplify it and be more visual but I was wondering if there could be any drawback.

[PhoneBoy]

In terms of performance, it should make no difference.
It's also an example of where Policy Layers can be useful, though I might personally use an inline layer instead.
Horses for courses, though 🙂

[Luis_Miguel_Mig]

Even though I think it is a good idea to have a separate layer for mgmt just for clarity, just realizing that in order to work it would need to be the last order layer and it defeats the purpose because we  want the mgmt rule to be matched at the begining.

I think you are right and I will leave it as an inline layer within the general data plane ordered layer

[PhoneBoy]

If you wanted to do it with ordered layers, why couldn't it be the first one?
That first layer would just have to accept traffic not destined for the gateway.
That said, it might create some issues with logging since, when multiple ordered layers are used, I believe it shows only the rule number in the first layer in the various tables.
That suggests an inline layer is probably the better option.

[Luis_Miguel_Mig]

It is okay for traffic not destined for the gateway.

The problem is for traffic destined for the gateway.

The mgmt rule basically accepts specific traffic to the gateway like ssh for example but if you get a hit in an ordered layer you move to the next ordered layer until you get a drop or until the get to an accept in the last ordered layer, no?

As far as I understand you can't get an accept in the first ordered layer and stop there

[PhoneBoy]

If you use ordered layers, then the traffic must hit an accept rule in each layer, you are correct.

[Luis_Miguel_Mig]

Going back to one of your comments. Why do we show the rule number of the first layer? 
The rule that really matters is the rule hit in the last ordered layer, no? It would way more useful if it was that way.

[PhoneBoy]

Why it does this I'm not sure, but that's the behavior I've observed.