SonicOS Packet flow in Global and Policy Mode

02/06/2024 2 People found this article helpful 142,869 Views

Description

This document covers a detailed view of SonicOS packet flow. This includes both the classic mode and the policy mode of firewall operation

Global Mode Packet Flow
This diagram illustrates the packet processing workflow through various firewall services in Global Mode(also called as Classic Mode), This also incorporates the latest features and updates introduced in SonicOS 7.1.1.
Global Mode represents the traditional configuration experience for SonicWall firewalls. It utilizes an object-based policy structure, where administrators define security policies based on specific objects like interfaces, addresses, and services. These policies dictate how the firewall handles incoming and outgoing traffic.

Supported Models:

All Gen7 Firewall models except NSsp15700

Key Features of Global Mode:

Object-based policies: Policies are built by defining rules based on network objects like interfaces, IP addresses, address groups, ports, protocols, and services.
Familiar interface: Long-time SonicWall users will find the interface familiar and intuitive.

Policy Mode (Simple View - Security Rule)
Packet Flow in this mode is similar to global mode except around Access Rule lookup. It is enhanced to do a full access rule lookup with additional details such as apps, web category, geo-ip and users compared to global mode.

In Policy mode Access Rules is renamed as Security Rules since we include full security services (IPS, GAV, ASPY, Botnet plus content actions) as part of the rule enforcements.
Security Policy rule has three parts-
- Match Criteria - Zones, IP addresses, Interfaces, Ports, Protocols, Countries, User, Apps, Web Categories, Websites and URLs and Patterns
- Action - Allow, Deny and Discard
- Security Rule Action -
  - Security services (IPS/GAV/ASPY, Botnet)
  - Content Filter User Actions and additional content related actions
  - BWM and QoS
  - Log and Block Page
  - Advanced/Miscellaneous
    - VoIP
    - TCP timeouts
    - Users
    - Fragmentation

Supported Models:

NSv 270/470/870
NSsp 15700

Not Finding Your Answers?

ASK THE COMMUNITY

Was This Article Helpful?

YES NO

SonicOS Packet flow in Global and Policy Mode

Description

Related Articles

Categories

Not Finding Your Answers?

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Follow Us

Subscribe to newsletter

Stay In Touch