Netgear SRXN3205 SRXN3205 Reference Manual - Page 143
Viewing Policies, An FTP server at 10.0.1.5, the user would be blocked by Policy 2.
UPC - 606449057461
View all Netgear SRXN3205 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 143 highlights
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual For example, a policy configured for a single IP address takes precedence over a policy configured for a range of addresses. And a policy that applies to a range of IP addresses takes precedence over a policy applied to all IP addresses. If two or more IP address ranges are configured, then the smallest address range takes precedence. Hostnames are treated the same as individual IP addresses. Network resources are prioritized just like other address ranges. However, the prioritization is based on the individual address or address range, not the entire network resource. For example, let's assume the following global policy configuration: • Policy 1: A Deny rule has been configured to block all services to the IP address range 10.0.0.0 - 10.0.0.255. • Policy 2: A Deny rule has been configured to block FTP access to 10.0.1.2 - 10.0.1.10. • Policy 3: A Permit rule has been configured to allow FTP access to the predefined network resource, FTP Servers. The FTP Servers network resource includes the following addresses: 10.0.0.5 - 10.0.0.20 and ftp.company.com, which resolves to 10.0.1.3. Assuming that no conflicting user or group policies have been configured, if a user attempted to access: • An FTP server at 10.0.0.1, the user would be blocked by Policy 1. • An FTP server at 10.0.1.5, the user would be blocked by Policy 2. • An FTP server at 10.0.0.10, the user would be granted access by Policy 3. The IP address range 10.0.0.5 - 10.0.0.20 is more specific than the IP address range defined in Policy 1. • An FTP server at ftp.company.com, the user would be granted access by Policy 3. A single host name is more specific than the IP address range configured in Policy 2. Note: The user would not be able to access ftp.company.com using its IP address 10.0.1.3. The firewall policy engine does not perform reverse DNS lookups. Viewing Policies To view the existing policies, follow these steps: Virtual Private Networking Using SSL v1.0, October 2008 7-15