O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

7.1. Configure an Inter-Zone Firewall Policy

Problem

You want to configure a basic firewall policy that permits specific traffic between two zones.

Solution

Figure 7-1 shows the Internal_fw gateway and its interfaces in the context of an inter-zone firewall policy that permits the Orion host to initiate HTTP (web) connections from the Trust zone to the Secure_Servers zone.

Inter-zone firewall policy configuration

Figure 7-1. Inter-zone firewall policy configuration

First, make sure you have correctly assigned the interface zones, IP addresses, and modes of the interfaces:

	Internal_fw-> set interface bgroup0 zone Trust
	Internal_fw-> set interface bgroup0 ip 192.168.4.1/24
	Internal_fw-> set interface bgroup0 route
	Internal_fw-> set zone name Secure_Servers
	Internal_fw-> set interface e0/0 zone Secure_Servers
	Internal_fw->set interface e0/0 ip 192.168.1.6/24

You can replace the bgroup0 and e0/0 interface names with your ScreenOS firewall's interface.

Next, define the address objects:

	Internal_fw-> set address Trust Orion 192.168.4.10/32 "Orion Wkstn"
	Internal_fw-> set address Secure_Servers Andromeda 192.168.1.30/32"Web Server"

Finally, configure the inter-zone firewall policies using the zones, address objects, and predefined HTTP service object:

	Internal_fw-> set policy from Trust to Secure_Servers Orion Andromeda
	 http permit log

	Internal_fw-> set policy from Secure_Servers to Trust Andromeda Orionany deny log

Discussion

A basic

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required