Chapter 6 - Security Policy

Chapter 6 – Security Policy
HCSA-NGFW 2022
1 Security Policy Basis
Contents
2 Object
3 Advanced Policy Configuration
4 Policy Configuration (CLI)

Security Policy Basis
Security Policy
• Security policy is the basic function of network security appliance.
• Policy is designed to control the traffic forwarding between security

zones/segments. By default, Hillstone devices will deny all traffic between security
zones/segments
• The policy can identify which flow between security zones or segments will be
permitted and which will be denied based on the policy rules.
www.hillstonenet.com
Basic Elements of Policy Rules
• Policy filtering conditions ：
– Source Zone/Address - The source zone/address of the traffic.
– Destination Zone/Address – The destination zone/address of the traffic.
– Service – The service type of the traffic.
– *User
– *Application
• Action ：
– Permit 、
– Deny 、
– WebAuth 、
– Tunnel 、 From tunnel 、
– Portal Server
Policy Filtering Condition and Action
Policy > Security Policy, Click 『 New 』 to create a policy
Eth0/1 trust Eth0/4 untrust
Internet
PC User Web server

192.168.10.10 www.hillstonenet.com
Policy Position
• Policy > Security Policy edit of a policy rule and click 『 Options 』 to change the position of this policy
Matching Sequence of Policy Rules
• The first flow packet matches policy rule
• Matching sequence of policy rules ：

- When traffic flows into a Hillstone device, the device will query for policy rules in
the list by turns (from top to the bottom, not accord to policy ID), and processes the
traffic according to the first matched rule.
• The default policy rule denies all the traffic.
Matching Sequence Example
According to below network topology, can the PC access to FTP server? Which policy rule will be
matched?
PC2
192.168.10.0/24 FTP
Server
.2 E0/1 E0/4 Internet
trust .1 untrust
PC3
.3
Object
Object
• Object includes ：
- Address Book
- Host Book
- Service Book
- APP Book
- Schedule
- AAA server 、 User and Role
- Track Object
• We will introduce the Top 5 objects here.
Configure Address Book (WebUI)
Object > Address Book, click 『 New 』
Host Book
Object > Host Book, click 『 New 』 , Regular expression is also supported.
Service Book （ WebUI ）
Object > Service Book > Service
Is able to see the predefined services
CLI ： show service predefined

User-defined Service （ WebUI ）
User-defined Service Group （ WebUI ）
Application Book
• Object > APP Book > Application
You can view or edit the predefined applications, the predefined application will be updated online automatically.
CLI ： show application predefined

Schedule
• Schedule includes: Days and Timeframe
• Schedule controls the effectiveness for

some functions, such as allows a policy
rule to take effect in a specified time,
controls the duration of the connection
between a PPPoE interface and Internet,
referenced by QoS etc.
• Must set correct system time

before using schedule
Create a Schedule
Object > Schedule. Click 『 New 』 to create a schedule.
Apply Schedule to a Policy Rule
Click Security > Security Policy. Click 『 New 』 to create a policy rule which blocks the game
applications access from the trust zone to the untrust zone within specified schedule.
Advanced Policy Configuration
Check / Move the Policy Position
Policy > Security Policy
To move a policy rule, in the policy rule configuration mode, use the following command:
move id {top | bottom | before id | after id}
22 www.hillstonenet.com
Policy Hit Count
• Statistic of policy usability, can be used to judge the validity of policy
SG-6000# show policy hit-count

Most hit policy rules:
===================================================================
=No. Id Name Src-zone Dst-zone Src-addr Dst-addr Service Applica~ Action Hit-count
-------------------------------------------------------------------------------------------------------------------
-
1 2 vpn trust untrust vpn branch1 Any PERMIT 1053
2 3 office trust untrust prov .. dmz Any PERMIT 579
3 4 untrust trust dmz Any Any PERMIT 0
4 1 Any Any Any Any Any PERMIT 1012www.hillstonenet.com
5 dft Any Any 0
Policy Redundancy Check
Policy Import/Export
• Only support DAT format
Session Displayed in Policy
• Session detail can be checked in policy
Stateful Inspection Technology （ Session ）
SG-6000# show session
Device: max 100000, alloc 32, deny session 0, free 99968, tunnel 0, alloc failed 0
================================================================
session: id 6, proto 6, flag a, flag1 20000, created 28309, life 1641, policy 2,app 93(HTTPS) flag 0x0,
auth_user_id 0, reverse_auth_user_id 0
flow0(19(ethernet0/7)/40200810): 1.1.1.20:56606->40.100.2.98:443
flow1(16(ethernet0/4)/200810): 40.100.2.98:443->200.0.0.10:56606
• Session is the state of connection between two parties on a firewall, one session is a connection between two sides. The
collection of multiple sessions on a firewall is called a session table
• Session created for the first packet, the following packets will try to search and match the existing session.
• Session includes ：
Source address 、 Source port 、 Destination address 、 Destination port 、 Protocol 、 Application 、 User
Policy Configuration (CLI)
Configure Policy Rule （ CLI ）
• To enter the policy configuration mode, in global configuration mode, use the following command:
policy-global ：
• After entering the policy configuration mode, to create a policy rule, use the following command:
•rule [id id] [top | before id | after id] [role {UNKNOWN | role-name} | user aaa-server-name user-name | user-
group aaa-server-name user-group-name] from src-addr to dst-addr service service-name {permit | deny | tunnel
tunnel-name | fromtunnel tunnel-name | webauth | portal-server}
• id id - Specifies the ID of the policy rule. If not specified, the system will automatically assign an ID to the policy
rule.
• top | before id | after id - Specifies the location of the policy rule.
By default, the newly-created policy rule is located at the end of all the rules.
• from src-addr - Specifies the source address of the policy rule.
• to dst-addr - Specifies the destination address of the policy rule.
• service service-name - Specifies the service name of the policy rule.
- permit | deny | tunnel tunnel-name| fromtunnel tunnel-name | webauth aaa-server | portal-server
- Specifies the action of the policy rule
Configure Policy Rule (Cont.)
• show policy [id id] [from src-zone] [to dst-zone]
• id id – Shows the detailed information of the specified policy rule.
• from src-zone – Shows the detailed information of the policy rule whose source security zone is the
specified zone.
• to dst-zone – Shows the detailed information of the policy rule whose destination security zone is
the specified zone.
• Another way to configure policy rule:

rule from any to any from-zone trust to-zone untrust service any permit
Questions
1. What are the basic elements of a policy rule ？
• Policy filtering conditions ： ,,, Action ：
2. What actions does the policy rule support?

Permit 、 Deny WebAuth 、 Tunnel 、 From tunnel 、 Portal Server
1. What is the matching sequence of policy rules?

de cima para baixo, não de acordo com a ID da política) e processará o tráfego de acordo com a primeira regra correspondente.
2. What is the default policy for the interfaces within same security zone?
A política foi projetada para controlar o encaminhamento de tráfego entre zonas/segmentos de segurança. Por padrão, os dispositivos Hillstone negarão todo o tráfego entre
zonas/segmentos de segurança
3. What is the supported file format for policy import ？

• Suporta apenas o formato DAT
Thanks

Chapter 6 - Security Policy

Uploaded by

Copyright:

Available Formats

You might also like

Chapter 6 - Security Policy

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 6 - Security Policy

Uploaded by

Copyright:

Available Formats

Chapter 6 – Security Policy

3 Advanced Policy Configuration

4 Policy Configuration (CLI)

• Policy is designed to control the traffic forwarding between security

PC User Web server

• Matching sequence of policy rules ：

• The default policy rule denies all the traffic.

• We will introduce the Top 5 objects here.

CLI ： show service predefined

CLI ： show application predefined

• Schedule controls the effectiveness for

• Must set correct system time

SG-6000# show policy hit-count

• Another way to configure policy rule:

2. What actions does the policy rule support?

1. What is the matching sequence of policy rules?

3. What is the supported file format for policy import ？

You might also like