Firewall configuration | Firewall policy options |
|
|
Firewall policy options
This section describes the options that you can add to firewall policies.
Source
Select an address or address group that matches the source address of the packet. Before you can add this address to a policy, you must add it to the source interface. To add an address, see “Addresses” on page 150.
Destination
Select an address or address group that matches the destination address of the packet. Before you can add this address to a policy, you must add it to the destination interface. To add an address, see “Addresses” on page 150.
For NAT/Route mode policies where the address on the destination network is hidden from the source network using NAT, the destination can also be a virtual IP that maps the destination address of the packet to a hidden destination address. See “Virtual IPs” on page 160.
Schedule
Select a schedule that controls when the policy is available to be matched with connections. See “Schedules” on page 157.
Service
Select a service that matches the service (port number) of the packet. You can select from a wide range of predefined services or add custom services and service groups. See “Services” on page 153.
Action
Select how the firewall should respond when the policy matches a connection attempt.
ACCEPT | Accept the connection. If you select ACCEPT, you can also configure NAT |
| and Authentication for the policy. |
DENY | Deny the connection. The only other policy option that you can configure is |
| log traffic, to log the connections denied by this policy. |
ENCRYPT | Make this policy an IPSec VPN policy. If you select ENCRYPT, you can |
| select an AutoIKE key or Manual Key VPN tunnel for the policy and configure |
| other IPSec settings. You cannot add authentication to an ENCRYPT policy. |
| ENCRYPT is not available in Transparent mode. See “Configuring encrypt |
| policies” on page 196. |
NAT
Configure the policy for NAT. NAT translates the source address and the source port of packets accepted by the policy. If you select NAT, you can also select Dynamic IP Pool and Fixed Port. NAT is not available in Transparent mode.
145 |
