Moxa EDR-810 User Manual download pdf (Page 106)

Industrial Secure Router User's Manual Firewall

8-8

Policy Check

The Industrial Secure Router supports a PolicyCheck function for maintaining the firewall policy list. The

PolicyCheck function detects firewall policies that may be configured incorrectly.

PolicyCheck provides an auto detection function for detecting common configuration errors in the Firewall

policy (e.g., Mask, Include, and Cross conflict). When adding a new firewall policy, the user just needs to

click the PolicyCheck button to check each policy; warning messages will be generated that can be used for

further analysis. If the user decides to ignore a warning message, the Industrial Secure Router firewall will run

on the configuration provided by the user.

The three most common types of configuration errors are related to Mask, Include, and Cross Conflict.

Mask: Policy [X] is masked by Policy [Y]

The Source/Destination IP range or Source/Destination port number of policy [X] is smaller or equal to policy

[Y] but the action target (Accept/Drop) is different.

For example, two firewall policies are shown below:

Index Input Output Protocol Source IP Destination IP Target

1 WAN1 LAN All 10.10.10.10 192.168.127.10 ACCEPT

2 WAN2 LAN All 20.20.20.10

to 20.20.20.30

192.168.127.20 ACCEPT

Suppose the user next adds a new policy with the following configuration:

Index Input Output Protocol Source IP Destination IP Target

3 WAN2 LAN All 20.20.20.20 192.168.127.20 DROP

After clicking the PolicyCheck button, the Industrial Secure Router will issue a message informing the user

that policy [3] is masked by policy [2] because the IP range of policy [3] is smaller than the IP range of policy

[2], and the Target action is different.

1 2 ... 101 102 103 104 105 106 107 108 109 110 111 ... 128 129

No comments

Moxa EDR-810 User Manual Page 106