Please enable JavaScript.
Coggle requires JavaScript to display documents.
🌐 Day 4 - Coggle Diagram
🌐 Day 4
Firewall Policies Basics
-
-
-
-
-
-
🗺️ Address Objects
- Define Layer 3 identity (who/where traffic is from/to).
- Mandatory: Must define at least one Source address.
-
-
-
-
- Dynamic / Fabric Connector
- ISDB objects cannot mix with standard ones.
-
🚦 Use in Routing
- Address objects (Subnet/FQDN) can be used in static routes.
🔢 Service Definitions
- Define allowed protocols/ports (Layer 4).
-
- Allowing ALL enables any protocol/port.
- Avoid allowing HTTP in production unless necessary.
⏰ Schedules
- Define active time windows for policies.
-
🚫 Implicit Deny Rule
- Default rule at bottom: silently drops unmatched traffic.
- In labs, enable logging to see dropped packets.
🧾 Policy Actions
- ACCEPT → Traffic permitted → Apply security profiles.
- DENY → Drop connection → No inspection.
- Implicit Deny = final safety net.
📊 Logging & Visibility
- Essential for diagnostics and monitoring.
- Security Events (default): logs blocked/monitored traffic.
- All Sessions: logs all accepted & denied traffic (useful in labs).
- Use Forward Traffic logs.
- Shows policy ID, source, destination, result.
- Right-click a policy → "Show Matching Logs".
- Retrieval speed varies (local memory vs cloud).
🧠 Summary
- Policies control what passes through firewall.
- Combine Routing, NAT, and Permissions.
- Sequential processing → top-down match.
- Implicit Deny ensures security by default.
- Logging provides full visibility into firewall behavior.