Configuring the Firewall Access Policy and Blade

1. Navigate to the Access Policy view > Firewall section > Blade Control page.

2. Select one of these options to set the default Access Policy:

   • Strict - Blocks all traffic unless explicitly allowed. Use this option for maximum security.

     In this mode, your policy can only be defined through the Servers page and by manually defining access policy rules in the Access Policy > Firewall Policy page.

   • Standard - Default option. Allows outgoing traffic and internal communication, and blocks incoming unencrypted traffic from untrusted sources.

   • Off - Disables the firewall and allows unrestricted traffic. Manually defined rules are not applied. Do not use this option in secured environments.

1. Click all services.

2. Select one of these:

   • Block all outgoing services except the following - Select which services to allow.

   • Allow all outgoing services - To allow all services.

3. Click Save.

1. Go to the Access Policy > Blade Control page.

2. Add manual rules for exceptions or specific requirements:

   • If no manual rules are configured, click the Firewall Policy link to add manual rules to the Firewall policy.

   • To view and modify existing rules, click manual rules.

3. Click Servers to see how many servers are defined in the appliance and to define server specific policies. A server object is an IP address that can have a specific access policy assigned to it.

   1. If no servers are configured, click Add a server.

   2. Define NAT rules if applicable (for example, port forwarding).

4. Automatically generated access rules to servers are created above the default policy rules and can be seen in the Access Policy > Firewall Policy page. You can also create exception rules for servers.

1. In the Access Policy > Firewall > Blade Control page, go to the Application and URL Filtering section.

2. Select the applicable options:

   • Block security risk categories - Block applications and URLs that can be a security risk and are categorized as spyware, phishing, botnet, spam, anonymizer, or hacking. This option is selected by default.

   • Block inappropriate content - Block Internet access to websites with inappropriate content such as sex, violence, weapons, gambling, and alcohol.

   • Block file sharing applications - Block file-sharing from typically illegal sources such as torrents and peer-to-peer applications. 

   • Block other undesired applications - Click this option to manage your basic Application & URL Filtering policy. Manually add and block applications or categories of URLs to a group of undesired applications. You can also create a new URL or application if it is not in the database.

   • Limit bandwidth consuming applications - Applications that use a lot of bandwidth can decrease performance necessary for important business applications. This option gives accelerated QoS (bandwidth control) for applications. When you select this option, P2P file sharing, media sharing, and media streams are selected by default but you can edit the group to add applications or categories that you want to limit with regards to the amount of bandwidth they consume.

     Note - You must indicate the maximum bandwidth limit according to your Internet connection upload and download bandwidth. Consult your ISP for this information. For the limit to be effective, it must be lower than the actual bandwidth supplied by your ISP. Upload and download bandwidths are usually not the same.

Use this mode to enforce rules based only on URL categories:

• Predefined applications are not blocked.

• Custom applications and URLs are enforced.

The default policy defined here is viewed as automatically generated rules in the bottom of the Outgoing traffic Rule A set of traffic parameters and other conditions in a Rule Base that cause specified actions to be taken for a communication session. Base in the Access Policy > Policy page.