Understanding Action Objects and how to add them

05/11/2020 0 2621

DESCRIPTION:

Action Objects define how the App Rules policy reacts to matching events. There are options to create a custom action object or select one of the predefined, default actions.

RESOLUTION:

There are a number of system-defined, default actions that are predefined by SonicOS. These default action objects cannot be edited or deleted. The default actions are displayed in the Edit App Rule Policy dialog when you add or edit policy from the Manage | Rules | App Rules page.

Several BWM action object options are available in the predefined, default action list. The BWM action options change depending on the Bandwidth Management Typesetting on the Firewall Settings | Bandwidth Management page. If the Bandwidth Management Type is set to Global, all eight priorities are selectable. If the Bandwidth Management Type is set to Advanced, no priorities are selectable, but the predefined priorities are available when adding a policy.

Several Bypass action options are available in the default action list. These are available if the indicated security services are licensed on the firewall.

Predefined Default Action Availability:

Predefined Default Action Object Descriptions:

Action Types for Custom Action Objects: 

The Action types available for creating custom action objects are displayed in the Add/Edit Action Object dialog, which is displayed when you click Add at the top of the Manage | Objects | Action Objects page.

NOTE: You can create custom action objects using the Action types available under Action Object Settings in the Add/Edit Action Object dialog. The default predefined action objects cannot be edited or deleted. When you create a policy, the Edit App Control Policy dialog provides a way for you to select from the predefined action objects along with any custom actions that you have defined.

Action Types for Custom Action Objects:

A priority setting of zero is the highest priority. Guaranteed bandwidth for all levels of BWM combined must not exceed 100%.

Actions Using Bandwidth Management:

Application layer bandwidth management (BWM) allows you to create policies that regulate bandwidth consumption by specific file types within a protocol while allowing other file types to use unlimited bandwidth. This enables you to distinguish between desirable and undesirable traffic within the same protocol. Application layer bandwidth management is supported for all Application matches, as well as custom App Rules policies using HTTP client, HTTP Server, Custom, and FTP file transfer types.

If the Bandwidth Management Type on the Firewall Settings > Bandwidth Management page is set to Global, application layer bandwidth management functionality is supported with eight predefined, default BWM priority levels, available when adding a policy from the Rules > App Rules page.

All application bandwidth management is tied in with global bandwidth management, which is configured on the Manage | Firewall Settings | Bandwidth Management page.

TIP: As a best practice, configure the global Bandwidth Management settings on the Firewall Settings | Bandwidth Management page should always be done before configuring any BWM policies.

Add/Edit Action Objects Page with Bandwidth Management Type Global:

NOTE: All priorities are displayed (Realtime - Lowest) regardless of whether they have been configured. Refer to the Firewall Settings > Bandwidth Management page to determine which priorities are enabled. If the Bandwidth Management Type is set to Global and you select a Bandwidth Priority that is not enabled, the traffic is automatically mapped to the level 4 priority (4 Medium).

With Advanced mode of BWM, the Advanced BWM action objects can be edited from Manage | Objects > Bandwidth Objects tab.

Bandwidth Management Methods:

The Bandwidth Management feature can be implemented in two separate ways:

1. Per Policy Method – The bandwidth limit specified in the policy is applied individually to each policy 
   

   EXAMPLE: Two policies each have an independent limit of 500kb/s, the total possible bandwidth between those two rules is 1000kb/s.

2. Per Action Aggregate Method – The bandwidth limit action is applied (shared) across all policies to which it is applied.
   

   EXAMPLE: Two policies share a BWM limit of 500kb/s, limiting the total bandwidth between the two policies to 500kb/s.

To configure an Action Object:

1. In the MANAGE view, navigate to Policies | Objects > Action Objects.
2. At the top of the page above the table, click Add.
   
3. In the Add/Edit Action Object dialog, type a descriptive name in the Action Name field.
4. In the Action drop-down menu, select the action type that you want.
5. In the Content field, type the text or URL to be used in the action.
   
   
6. If HTTP Block Page was selected as the action type, the options change.
   a) In the Content field, enter the content to be displayed when a page is blocked.
   b) From the Color drop-down menu, choose a background color for the block page: White, Yellow, Red, Blue
   c) To preview the block page message, click the Preview button.
   
   
7. If Bandwidth Management was selected as the action type, the options change.
8. Click OK
   
   

   NOTE: Action objects are used in conjunction with Match objects to create App rules. Please use the link Most Common Configurations For App Rules to look at the way these Match Objects can be used for specific scenarios.