O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

7.10. Configure an Intra-Zone Firewall Policy

Problem

You want to configure a ScreenOS intra-zone policy that implements and logs secure firewall sessions between systems on the same security zone.

Solution

Figure 7-4 shows the Internal_fw gateway and its interfaces in the context of a firewall policy between devices on the same Trust zone that permits the Orion host to initiate ping and HTTP connections to Gemini but denies all other connections.

Intra-zone firewall policy configuration

Figure 7-4. Intra-zone firewall policy configuration

First, the required address book and service group entries are created:

	Internal_fw-> set address Trust Gemini 192.168.5.10/32
	Internal_fw-> set group service ping_http
	Internal_fw-> set group service ping_http add ping
	Internal_fw->set group service ping_http add http

Next, intra-zone blocking is enabled on the Trust zone, and the intra-zone policy is configured:

	Internal_fw-> set zone Trust block
	Internal_fw-> set policy from Trust to Trust Orion Gemini ping_http
	permit log
	policy id = 20
	Internal_fw-> set policy from Trust to Trust Orion Gemini any deny
	log
	policy id = 21
	Internal_fw->

Discussion

In the solution to this recipe, the two distinct IP interfaces, bgroup0 and ethernet0/1, on the Internal_fw gateway are in the same Trust security zone. To enable stateful firewalling between devices on these separate interfaces on the same zone, intra-zone policies are employed.

In its default configuration, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required