-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
SMA 100 Series: Information on Access Policy Hierarchy
03/26/2020 
39 People found this article helpful
484,629 Views
Description
Information on Access Policy Hierarchy
Resolution
SMA 100 Series: Information on Access Policy Hierarchy.
An administrator can define user, group and global policies to predefined network objects, IP addresses, address ranges, or all IP addresses and to different SMA services. Certain policies take precedence.
The SonicWall SMA policy hierarchy is:
User policies take precedence over group policies
Group policies take precedence over global policies
If two or more user, group or global policies are configured, the most specific policy takes precedence
For example, a policy configured for a single IP address takes precedence over a policy configured for a range of addresses. A policy that applies to a range of IP addresses takes precedence over a policy applied to all IP addresses. If two or more IP address ranges are configured, then the smallest address range takes precedence.
Host names are treated the same as individual IP addresses.
Network objects are prioritized just like other address ranges. However, the prioritization is based on the individual address or address range, not the entire network object.
For example:
Policy 1: A Deny rule has been configured to block all services to the IP address range 10.0.0.0 -
10.0.0.255
Policy 2: A Deny rule has been configured to block FTP access to 10.0.1.2 - 10.0.1.10
Policy 3: A Permit rule has been configured to allow FTP access to the predefined network object, FTP Servers. The FTP Servers network object includes the following addresses: 10.0.0.5 - 10.0.0.20. and ftp.company.com, which resolves to 10.0.1.3.
Assuming that no conflicting user or group policies have been configured, if a user attempted to access:
An FTP server at 10.0.0.1, the user would be blocked by Policy 1
An FTP server at 10.0.1.5, the user would be blocked by Policy 2
An FTP server at 10.0.0.10, the user would be granted access by Policy 3. The IP address range 10.0.0.5 - 10.0.0.20 is more specific than the IP address range defined in Policy 1.
An FTP server at ftp.company.com, the user would be granted access by Policy 3. A single host name is more specific than the IP address range configured in Policy 2.
NOTE: In this example, the user would not be able to access ftp.company.com using its IP address 10.0.1.3. The SRA policy engine does not perform reverse DNS lookups.
Related Articles
- How to Set Timeout for Inactive Tunnel Connections
- Commands for silent installation of NetExtender via CMD line
- Users on Netextender 10.3.0 version failing to connect with the following error message " Cannot get a response from the server "
YES
NO