SonicWALL SonicWALL UTM Appliance manual

Page 18

•Rule processing stops as soon as there is a match (with some caveats – see below)

•Rule logic first looks at Source, then Destination, Service, and Action. If there is a match there, rule processing stops and then further subset rule processing can happen (rules set for schedules, users/groups, or BWM) for that specific rule.

o What cannot occur is two overlapping rules for the same service for different groups. For example, if you had a FW rule that allowed FTP for Group 1, and below it a FW rule to allow FTP for Group 2, Group 2 would never be allowed to use FTP. The first rule that gets a match is the allow rule for FTP – and it only applies for Group 1. Recall that rule processing

first looks at Source, Destination and Service. As soon as there is a match, rule processing stops. Because of that, the 2nd FTP rule would never be reached.

In the following example, we’ll demonstrate how you can leverage firewall rules to allow a certain group of users to download POP email, while the rest of the organization is denied.

First, create a rule a rule from LAN > WAN (note this could be from any zone you want to enforce this policy on, not just the LAN) that allows POP traffic for your LDAP group.

NOTE: The user or group is not used in selecting which rule to apply. You should always set a rule for the service, source, and destination. In that rule, select the user or group to be

18

Page 17 Page 19
Image 18
Page 17 Page 19
Contents Contents Page Configuring the CA on the Active Directory Server Integrating LDAP/Active Directory with Sonicwall UTMConfiguring the SonicWALL Appliance for Ldap Importing the CA Certificate onto the SonicWALLPage Page Page Page Page Page Page Enable Radius to Ldap Relay Enables this feature Authentication Page Page Page SonicOS Options That Leverage Groups/Users Creating Firewall Rules with Ldap Groups/UsersPage Page Firewall Rules with Bandwidth Management & Logging Page Blocking Websites Domain Names for Groups/Users Blocking Domains with Firewall RulesPage Page Navigate to Firewall Access Rules Create a rule to allow Http traffic for your allowed lists Do the same for Https Create the deny rules for Http and Https Firewall rules should now look like the below picture Blocking Https SSL Domains with SSL Control Configuring a SSL Blacklist and Whitelist Page Applying Different CFS Policies to Groups Page Creating Custom CFS Policies Navigate to the Policy tab and add a new CFS policy Page Page Page Variables for Custom Block Page in SonicOS Http//$$fwinterface$$/$#SWLSTYLESCSS#$Basic Sample Code for SonicOS Advanced Sample Code for SonicOSPage Page Sample JavaScript Code for SonicOS Sample Code for SonicOS 5.1 or EarlierApplying Application Firewall Polices to Groups/Users Page Page Page Page Tightening Control over the Browsing Behavior of Users Blocking IM Traffic Categorically Applying Granular IM Policies Applying VPN Access Policies to Groups/Users Global VPN Client GVCPage SSL-VPN NetExtender Guest Services Wireless Guest Services
Top Page Image Contents