ZyWALL 50 Internet Security Gateway

Ordering Your Rules

Ordering your rules is important because the ZyWALL applies the rules in the order that you specify. When a rule matches the current packet, the ZyWALL takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9.

Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6.

Table 6-5 Fields in Menu 15.1.1

 

FIELD

DESCRIPTION

EXAMPLE

 

 

 

 

 

Set Name

Enter a name for this set of rules. This is a required field. If this

NAT_SET

 

 

field is left blank, the entire set will be deleted.

 

 

Action

The default is Edit. Edit means you want to edit a selected rule

Edit

 

 

(see following field). Insert Before means to insert a rule before

 

 

 

 

the rule selected. The rules after the selected rule will then be

 

 

 

 

moved down by one rule. Delete means to delete the selected rule

 

 

 

 

and then all the rules after the selected one will be advanced one

 

 

 

 

rule. None disables the Select Rule item.

 

 

Select Rule

When you choose Edit, Insert Before or Delete in the previous

1

 

 

 

field the cursor jumps to this field to allow you to select the rule to

 

 

 

 

apply the action in question.

 

 

 

 

 

 

 

 

 

 

 

 

You must press [ENTER] at the bottom of the screen to save the whole set. You must

do this again if you make any changes to the set – including deleting a rule. No

changes to the set take place until this action is taken.

Selecting Edit in the Action field and then selecting a rule brings up the following menu, Menu 15.1.1.1 - Address Mapping Rule in which you can edit an individual rule and configure the Type, Local and

Global Start/End IPs.

An End IP address must be numerically greater than its corresponding IP Start

address.

NAT

6-11