Chapter 20 Security Policy
USG20(W)-VPN Series User’s Guide
320
Default Directional Security Policy Behavior
Security Policies can be grouped based on the direction of travel of packets to which they apply.
Here is the The USG has default Security Policy behavior for traffic going through the USG in
various directions.
To-Device Policies
Policies with
Device
as the
To Zone
apply to traffic going to the USG itself. By default:
• The Security Policy allows only LAN, or WAN computers to access or manage the USG.
• The USG allows DHCP traffic from any interface to the USG.
• The USG drops most packets from the WAN zone to the USG itself and generates a log except for
AH, ESP, GRE, HTTPS, IKE, NATT.
When you configure a Security Policy rule for packets destined for the USG itself, make sure it does
not conflict with your service control rule. The USG checks the security policy before the service
control rules for traffic destined for the USG.
A
From Any To Device
direction policy applies to traffic from an interface which is not in a zone.
Global Security Policies
Security Policies with
from any
and/or
to any
as the packet direction are called global Security
Policies. The global Security Policies are the only Security Policies that apply to an interface that is
not included in a zone. The
from any
policies apply to traffic coming from the interface and the
to
any
policies apply to traffic going to the interface.
Security Policy Rule Criteria
The USG checks the schedule, user name (user’s login name on the USG), source IP address and
object, destination IP address and object, IP protocol type of network traffic (service) and UTM
profile criteria against the Security Policies (in the order you list them). When the traffic matches a
policy, the USG takes the action specified in the policy.
Table 125
Directional Security Policy Behavior
FROM ZONE TO ZONE
BEHAVIOR
From any to Device
DHCP traffic from any interface to the USG is allowed.
From LAN1 to any (other than
the USG)
Traffic from the LAN1 to any of the networks connected to the USG is allowed.
From LAN2 to any (other than
the USG)
Traffic from the LAN2 to any of the networks connected to the USG is allowed.
From LAN1 to Device
Traffic from the LAN1 to the USG itself is allowed.
From LAN2 to Device
Traffic from the LAN2 to the USG itself is allowed.
From WAN to Device
The default services listed in
To-Device Policies on page 320
are allowed from
the WAN to the USG itself. All other WAN to USG traffic is dropped.
From any to any
Traffic that does not match any security policy is dropped. This includes traffic
from the WAN to any of the networks behind the USG.
This also includes traffic to or from interfaces that are not assigned to a zone
(extra-zone traffic).
Summary of Contents for ZyWall USG20-VPN
Page 17: ...17 PART I User s Guide ...
Page 18: ...18 ...
Page 99: ...99 PART II Technical Reference ...
Page 100: ...100 ...
