Policy to allow only internet access

  • 0
  • 2
  • Question
  • Updated 1 year ago
  • Answered
I'm trying to setup a Internet only Policy for wired ports.  I've created permit role and added deny destination rules for our local networks.  I've also added allow rules for dns, dhcp, etc.   It looks like rule precedence is tripping me up as the denys are before the permits so everthing is blocked locally.  Is there a way to make rules have different precedence or a diffrent way to do this.


Photo of Matthew Perry

Matthew Perry

  • 320 Points 250 badge 2x thumb

Posted 1 year ago

  • 0
  • 2
Photo of Mike Thomas

Mike Thomas, Employee - GTAC - NMS

  • 7,650 Points 5k badge 2x thumb
Matthew, what is the hardware type? Some can change the precedence, but usually the more complex rules are hit first.
Photo of Matthew Perry

Matthew Perry

  • 320 Points 250 badge 2x thumb
Most of the edge switches are b-series.  
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
You could always start with a deny all rule and permit only what you need.
Photo of Matthew Perry

Matthew Perry

  • 320 Points 250 badge 2x thumb
Ya I was trying to think of a good way to do it in the opposite direction but couldn't figure out how that would look.
Photo of Matthew Perry

Matthew Perry

  • 320 Points 250 badge 2x thumb
I guess I could do a deny all and then permit all public IP networks.  That gets to be a crazy long list of permit rules as I would need to allow the following.  Anyone know what the max number of rules are on the b-series? 

1.0.0.0/8
2.0.0.0/7
4.0.0.0/6
8.0.0.0/7
11.0.0.0/8
12.0.0.0/6
16.0.0.0/4
32.0.0.0/3
64.0.0.0/2
139.0.0.0/8
140.0.0.0/6
144.0.0.0/4
160.0.0.0/5
168.0.0.0/6
172.0.0.0/12
172.32.0.0/11
172.64.0.0/10
172.128.0.0/9
173.0.0.0/8
174.0.0.0/7
176.0.0.0/4
192.0.0.0/9
192.128.0.0/11
192.160.0.0/13
192.169.0.0/16
192.170.0.0/15
192.172.0.0/14
192.176.0.0/12
192.192.0.0/10
193.0.0.0/8
194.0.0.0/7
196.0.0.0/6
200.0.0.0/6
204.0.0.0/8
205.0.0.0/9
205.128.0.0/11
205.160.0.0/13
205.168.0.0/14
205.172.0.0/20
205.172.16.0/22
205.172.24.0/21
205.172.32.0/19
205.172.64.0/18
205.172.128.0/17
205.173.0.0/17
205.173.128.0/20
205.173.144.0/21
205.173.160.0/19
205.173.192.0/18
205.174.0.0/15
205.176.0.0/12
205.192.0.0/10
206.0.0.0/7
208.0.0.0/4
Photo of Mike Thomas

Mike Thomas, Employee - GTAC - NMS

  • 7,650 Points 5k badge 2x thumb
So the Securestacks do not allow re-ordering of the policy. So there is no top->down execution of rules. There is a precedence. So the rules that are most complex (like your top rules with /24 bit masks, should hit first, and then your simplest ones (like ARP ethertype) should be hit last.

I think another approach to it is to look at the Unregistered Rule set that is part of the default policy domain. It effectively allows minimal traffic to talk to a NAC and get an IP address and do DNS, but no IP traffic (because the default policy is to Deny traffic). It may be a good model to work from.