Edit the Access policy

The Access policy defines which connections are allowed.

By default, the Access policy contains one rule for testing connectivity that allows HTTP, HTTPS, and ping traffic from all interfaces that belong to the internal zone to any destination. Log entries related to this traffic are stored on the NGFW Engine.

You can edit this rule and add other rules. By default, the NGFW Engine blocks all connections that have not been specifically allowed in the Access policy.

Table 1. Default rule in the Access policy
Name Source Destination Service Logging Action
Connectivity Testing Internal Zone ANY HTTP, HTTPS, Ping Stored Allow

Steps

  1. Browse to NGFW > Policy > Access or NGFW > Policy > NAT.
  2. Add a rule in one of the following ways:
    • Click Add First Rule.
    • Click a rule, select > New, then select Rule Before or Rule After.
  3. Configure the settings, then click Save.
  4. Publish the changes.

Example

Fields marked with an asterisk are mandatory.

Table 2. Access Policy
Option Definition
Source and Destination A set of matching criteria that defines the IP addresses and interfaces that the rule matches.
  • Type part of the name of an element or browse through the drop-down list to select an element.
  • Click Set to ANY to match any element.
Service A set of matching criteria that matches traffic based on the Network Application, or protocol and port.
  • Type part of the name of an element or browse through the drop-down list to select an element.
  • Click Set to ANY to match any element.
Logging Defines logging options for the rule.
  • Logging — When selected, enables logging for the rule.
  • Log Level — Defines the log level for matching connections.
    • None — Does not create any log entry
    • Transient — Creates a log entry that is shown on the Logs tab, but is not stored.
    • Stored — Creates a log entry that is stored on the NGFW Engine.
    • Essential — Creates a log entry that is shown on the Logs tab and saved for further use.
    • Alert — Triggers an alert with the severity that you define.
    • Automatic — This option is not supported in the Access policy.
  • Severity — When the Log Level is set to Alert, defines the severity of the alert.
  • Advanced Options — Allows you to define advanced logging options.
Action Command for the engine to carry out when a connection matches the rule.
  • Allow — Allows connections that match the rule.
  • Discard — Discards connections that match the rule.
  • Continue — Sets default options for traffic matching. The options are used for later rules that match the same criteria unless the later rules override the options.
  • Refuse — Refuses connections that match the rule.
  • Jump — The rule processing jumps to a Sub-Policy to continue processing rules.
  • Use VPN — Connections that match the rule are sent into the specified VPN.
  • Decryption — This option is not yet supported.
  • Advanced Options — Allows you to define advanced action options.
Table 3. Advanced Logging options
Option Definition
Log Level Defines the log level for matching connections.
Severity When the Log Level is set to Alert, defines the severity of the alert.
Connection Closing Specifies how log entries are created when connections are closed.
  • None — No log entries are created.
  • Normal — Both connection opening and closing are logged, but no information about the volume of traffic is collected.
  • Accounting — Both connection opening and closing are logged and information about the volume of traffic is collected.
Log Application Defines whether information about Application detection is included in the log data.
  • Off — Information about Application detection is not included in the log data.
  • Default — Information about Application detection is included in the log data if the information is available without additional inspection.
  • Enforced — Information about Application detection is always included in the log data if the Application can be identified.
Log URL Category Defines whether information about URL categorization is included in the log data.
  • Off — URL categories are not included in the log data.
  • Default — URL categories are included in the log data for matching traffic when URL Categories are used as matching criteria in the rule.
  • Enforced — URL categories are always included in the log data if the URL category can be identified.
Table 4. Advanced Action options
Option Definition
Deep Inspection Selects traffic that matches this rule for checking against the Inspection Policy.
  • On — The feature is enabled.
  • Off — The feature is disabled.
File Filtering This option is not yet supported.
Conntrack Mode
  • Off — The feature is disabled.
  • Default — The settings defined in the NGFW Engine properties are used.
  • Loose — Reply packets are allowed as part of the allowed connection without an explicit Access rule. The NGFW Engine allows some connection patterns and address translation operations that are not allowed in Normal mode.
  • Normal — Reply packets are allowed as part of the allowed connection without an explicit Access rule. The NGFW Engine drops ICMP error messages related to connections that are not currently active in connection tracking (unless explicitly allowed by a rule in the policy). A valid, complete TCP handshake is required for TCP traffic. The NGFW Engine checks the traffic direction and the port parameters of UDP traffic. If the Service cell in the rule contains a Service that uses a Protocol Agent, the NGFW Engine also validates TCP and UDP traffic on the application layer. If a protocol violation occurs, the packet that violates the protocol is dropped.
  • Strict — Reply packets are allowed as part of the allowed connection without an explicit Access rule. The NGFW Engine allows only TCP traffic that strictly adheres to the TCP standard as defined in RFC 793. The NGFW Engine also checks the sequence numbers of the packets in pre-connection establishment states and for RST and FIN packets, and drops packets that are out of sequence. If the Service cell in the rule contains a Service that uses a Protocol Agent, the NGFW Engine also validates the traffic on the application layer. If a protocol violation occurs, the packet that violates the protocol is dropped.
Idle Timeout

The timeout (in seconds) after which inactive connections are closed. This timeout concerns only idle connections. Connections are not cut because of timeouts while the hosts are still communicating.

If you enter a timeout, this value overrides the setting defined in the NGFW Engine properties.
Sync Connections This option is not yet supported.
TCP MSS When selected, TCP MSS is enforced. Headers are not included in the maximum segment size (MSS) value; MSS concerns only the payload of the packet. Usually, network equipment sends packets at the Ethernet-standard maximum transmission unit (MTU) size of 1500 (including both payload and headers).
  • Min — If a TCP packet has an MSS value smaller than the minimum you set here, the packet is dropped. The smaller the data content is, the less efficient the communications become due to the fixed-size headers. Limiting the minimum size can help alleviate certain types of network attacks. Typically, the value you enter is not larger than the default minimum TCP Maximum Segment Size (536).
  • Max — If a TCP packet has an MSS value larger than the maximum, the NGFW Engine overwrites the packet’s MSS with the maximum value you set here. Setting the maximum MSS size might be necessary to prevent fragmentation. Typically, the value you enter is lower than the standard Ethernet MTU (1500), taking the packet headers that are added to the MSS into account.
Decryption This option is not yet supported.