SonicOS 7.3 Rules and Policies for Classic Mode

Technical Documentation>  Access Rules>  Setting Firewall Access Rules>  Creating Access Rules
Table of Contents

Creating Access Rules

Access Rules provide the interface to add, delete, and modify policies. You can also select the desired zones for the traffic flow with the Zone Matrix Selector.

To create Access Rules

  1. Navigate to POLICY | Rules and Policies > Access Rules.

  2. Click the Zone Matrix Selector drop-down menu from the top bar and assign your LAN to the appropriate To Zone access rule. (This is the Zone of the private IP the server resides on.)

  3. Click + Add to launch the Adding Rule dialog.

  4. Select an Action for this service whether to Allow, Deny, or Discard.

  5. Select a Source and Destination from the Zone/Interface drop-down menus, which list any custom and default address objects created.

  6. Specify the Source Port/Services for the ingress traffic. By default, you can keep the Source service as Any.

  7. In the Destination section, for Service / SaaS App, select the traffic matching mode using radio buttons:

    Port/Services: Select a destination service object from the Port/Services drop-down. By default, keep the Destination Port configured.

    SaaS App: Select a preconfigured SaaS & AI Application Group from the SaaS App Group drop-down. If no group exists, click the edit icon to create one. For more information, refer to Adding a SaaS & AI Application Group.

    This feature is supported in SonicOS 8.2.3 and later versions.

  8. Click the User & TCP/UDP tab. Specify if this rule applies to all users or to an individual user or group in the User Include and Exclude options.

  9. Check Authenticate via SAML box and select SAML Profile from the drop-down menu to login via SAML authentication.

    For more information, refer to Configuring the SAML Profile.

  10. Specify how long (in minutes) TCP connections might remain idle before the connection is terminated in the TCP Inactivity Timeout field.

  11. Specify how long (in seconds) UDP connections might remain idle before the connection is terminated in the UDP Inactivity Timeout field.

  12. Clicking into the Security Profiles tab, you can configure a security profile for your access rule that includes enabling or disabling the DPI, Client DPI-SSL, and Server DPI-SSL services, as well as the Botnet/CC, Indicator of Compromise, and Geo-IP Filters based on firewall rule connections.

    Enable the By IoC IP Addresses option and choose one of the following:

    • Global – Includes all IoC IP addresses from all configured IoC IP Address Files in the access rule.
    • Custom – Allows you to select specific IoC IP Address Files to include in the access rule.

  13. You can configure egress and ingress bandwidth management on the firewall access rules for specific sources, destinations, and services.

  14. To track bandwidth usage for this service, enable Track Bandwidth Usage.
  15. To enable logging for this rule, click the Logging tab.

  16. The last tab is the Optional Settings tab. Specify the percentage of the maximum connections this rule is to allow in the Number of connections allowed (% of maximum connections) field.

  17. Set a limit for the maximum number of connections allowed per source IP address by selecting Enable Connection Threshold for each Source IP and entering the value in the field.

    Only available for Allow rules.

  18. Set a limit for the maximum number of connections allowed per destination IP address by selecting Enable Connection for each Destination IP and entering the value in the field.

    Only available for Allow rules.

  19. You can enable fragmented packets on the access rule as well as allow management traffic over the access rule, Click Add when finished.

  20. You can also show the diagram flow of the access rule created by enabling Show Diagram.