Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
Policy configuration basics
The following steps outline the basic processing that takes place when an
outbound Telnet connection request arrives at a Sidewinder G2 with the above
active rules in place.
1 A outbound Telnet request arrives at the Sidewinder G2.
2 The request is processed by the active IP Filter rules. No match is found, so
the request is forwarded to the proxies.
3 The request is processed by the proxies. The telnet proxy is listening
(enabled), so the request is forwarded to the active proxy rules.
4 The request is processed by the first rule in the Active Rules table, which is
the NetMeeting rule. The request does not match the rule criteria.
5 The request is forwarded to the next rule in the table, a rule group called
Administration, and is inspected in sequential order by each rule contained
within that group. No match is found in this rule group.
6 The request is forwarded to the next rule in the table, a rule called Internet
Services. A match is found (because the Telnet proxy is included in the
service group used in this rule).
7 The request is processed according to the specifications in the Internet
Services rule. The Internet Services rule is an allow rule with NAT enabled.
The request bypasses all other rules and groups contained in the active
rules table, the internal address of the request is translated, and the request
is granted.
Ordering proxy rules within a rule group
The order in which rules and nested groups appear in the active rule group is
significant. When the Sidewinder G2 is looking for a rule match, it searches the
active rules in sequential order (beginning with the first rule or nested group
within the group, then the second, and so on). The first rule that matches all the
characteristics of the connection request (service type, source, destination,
and so on) is used to determine whether to allow or deny the connection.
Therefore, you should always place rules that allow or deny the most frequent
traffic near the top of an active rule group to reduce the processing time.
Important: If the characteristics of a connection request matches more than one
rule, the first one it matches will be used and the search will stop.
For example, suppose you want to allow access to FTP services on the
Internet for all systems except those included in a netgroup called
“publications.” The scenarios below illustrate both the incorrect and correct rule
placement.
101