. . . . .
P O L I C Y C O N F I G U R A T I O N
Configuring Policies
Version 3R2
Security Appliance User Guide
9-7
Use the
set policy
command with the
name
option to add a name to an
existing policy:
set policy id {number} name {name} from {src_zone} to
{dst_zone} {src_addr} {dst_addr} {srvc} permit | deny |
reject
E X A M P L E : A D D I N G A N A M E T O T H E P O L I C Y F R O M T H E P R E V I O U S
E X A M P L E
set policy id 1 name ftpcorp from untrust to trust any
4.4.4.4 ftp permit
save
G U I E X A M P L E : A D D I N G A N A M E T O T H E P O L I C Y F R O M T H E
P R E V I O U S E X A M P L E
1
Policy > Configuration Edit
2
Enter the following, then click
Apply
.
Enable Policy
Name: ftpcorp
Action: permit
Source Zone: untrust
Destination Zone: trust
Source Address: any
Destination: 4.4.4.4
Service: FTP
REORDERING POLICES
Because the policy database is searched from top to bottom when
matching against traffic, you should order polices in the database from
most specific to least specific. Doing this ensures that a more general
policy does not block a more specific policy as illustrated by the policy
example below. In this example, policy 2 never matches against FTP
requests initiated from the trust zone to a server on the untrust zone
because the deny policy follows a more general allow policy.
E X A M P L E : R E O R D E R I N G P O L I C I E S
Set policy id 1 from trust to untrust any any any permit
