Configuring a CFS policy per IP address or range of IP addresses

04/15/2021 1711 25013

DESCRIPTION:

Appliances with SonicWall CFS Premium can now assign specific CFS policies to ranges of IP address ranges. This provides the ability to segment CFS policies within a single zone.

NOTE: Custom CFS policies can only be created when the appliance has a valid subscription for SonicWall CFS Premium.

RESOLUTION:

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

Creating a Custom CFS Policy.

1. Click on Object | Profile Objects | Content Filter.
2. Click on Add.
3. Enter Name.
4. Under Category Configuration , Block everything except Email.
5. Click Save.
   
   
   
   

Creating an address object for the ip address we want to have a separate policy.

1. Navigate to Object | Match Objects | Addresses.
2. Click Add , create an address object for the range of IP you want the CFS policy to be applied.
   
   

Apply the CFS Policy 

1. Navigate to Policy | Rules and Policies | Content Filter Policies.
2. Click Add.
3. Make sure to select Source IP as the IP range which we created  and Profile as the  ONLY EMAIL ACCESS.
4. Click OK.
   
   
   

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Creating a Custom CFS Policy.

1. Click MANAGE , navigate to Objects | Content Filter Objects.
2. Click CFS Profile Objects on the top.
3. Click ADD.
4. Enter Name.
5. Under Category Configuration , Block everything except Email.
6.  Click OK
   

Creating an address object for the ip address we want to have a separate policy.

1. Navigate to Objects | Address Objects.
2. Click Add , create an address object for the range of IP you want the CFS policy to be applied .
   

Apply the CFS Policy 

1. Navigate to Security Services | Content Filter .
2.  Under CFS Policies , Click Configure.
3. Make sure to select Source Ip as the IP range which we created in step 2  and Profile as the  ONlY EMAIL ACCESS.
4. Click ADD and  then click ACCEPT at the bottom.
   
   
   

   NOTE: Make sure that the newly created Policy has top priority .

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Creating a Custom CFS Policy.

1. Login to the SonicWall management Interface.
2. Navigate to Security Services | Content Filter page.
3. Click Configure button, and then Policy tab.
4. Click Add to create a new policy. The Add CFS Policy window is displayed.
5. Enter a name for the policy in the Name field.
6. Click URL List tab.
7. In the Select Forbidden Categories list, Uncheck any category to which you want to allow access. Move your mouse pointer over the Down or Up arrows to automatically scroll through the list of CFS categories. Select the Select all categories check box if you want to block all categories, or Uncheck the box to Uncheck all categories.
   
   
   
8. Click OK.
   
   

Applying the Custom CFS Policy per IP address or range of IP addresses

1.  Scroll down to the CFS Policy per IP Address Range section and select the Enable Policy per IP Address Range checkbox.
2. Click Add. The Add CFS Policy per IP Address Range window is displayed.
3.  Enter the first IP address in the range in the IP Address From: field and the last address in the IP Address To: field.
4. Select the CFS policy to apply to this IP address range in the CFS Policy: pull down window.
   
   
5. Optionally add a comment about this IP address range in the Comment: field.
6. Click OK.

How to Test:

Login to the any computer within the IP range specified and try to access the website allowed by the new custom policy, and also try to go to restricted websites.