Filter
Top Products
134
SONICWALL SONICOS 2.5 ENHANCED ADMINISTRATOR’S GUIDE
C
HAPTER
23:
Configuring Access Rules
Stateful Packet Inspection Default Access Rules Overview
By default, the SonicWALL security appliance’s stateful packet inspection allows all communication
from the LAN to the Internet, and blocks all traffic to the LAN from the Internet. The following
behaviors are defined by the “Default” stateful inspection packet access rule enabled in the
SonicWALL security appliance:
• Allow all sessions originating from the LAN to the WAN and DMZ.
• Allow all sessions originating from the DMZ to the WAN.
• Deny all sessions originating from the WAN to the DMZ.
• Deny all sessions originating from the WAN and DMZ to the LAN.
Additional network access rules can be defined to extend or override the default access rules. For
example, access rules can be created that block certain types of traffic such as IRC from the LAN to
the WAN, or allow certain types of traffic, such as Lotus Notes database synchronization, from
specific hosts on the Internet to specific hosts on the LAN, or restrict use of certain protocols such as
Telnet to authorized users on the LAN.
Custom access rules evaluate network traffic source IP addresses, destination IP addresses, IP
protocol types, and compare the information to access rules created on the SonicWALL security
appliance. Network access rules take precedence, and can override the SonicWALL security
appliance’s stateful packet inspection. For example, an access rule that blocks IRC traffic takes
precedence over the SonicWALL security appliance default setting of allowing this type of traffic.
S
Alert: The ability to define network access rules is a very powerful tool. Using custom access rules
can disable firewall protection or block all access to the Internet. Use caution when creating or
deleting network access rules.
Using Bandwidth Management with Access Rules
Overview
Bandwidth management allows you to assign guaranteed and maximum bandwidth to services and
prioritize traffic on all WAN zones. Using access rules, bandwidth management can be enabled on a
per-interface basis. Packets belonging to a bandwidth management enabled policy will be queued in
the corresponding priority queue before being sent on the bandwidth management-enabled WAN
interface. All other packets will be queued in the default queue and will be sent in a First In and First
Out (FIFO) manner (a storage method that retrieves the item stored for the longest time).
Example Scenario
If you create an access rule for outbound mail traffic (such as SMTP) and enable bandwidth
management with the following parameters:
• Guaranteed bandwidth of 20 percent
• Maximum bandwidth of 40 percent
• Priority of 0 (zero)
The outbound SMTP traffic is guaranteed 20 percent of available bandwidth available to it and can get
as much as 40 percent of available bandwidth. If this is the only access rule using bandwidth
management, it has priority over all other access rules on the SonicWALL security appliance. Other
access rules use the remaining bandwidth (minus 20 percent of bandwidth, or greater than minus 20
percent and less than minus 40 percent of bandwidth).
Note: Access rules using bandwidth management have a higher priority than access rules not using
bandwidth management. Access rules without bandwidth management are given lowest priority.