Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 8: Creating Rules and Rule Groups
Creating IP Filter rules
Entering information
on the Rule tab
230
To configure the Rules tab for an IP Filter rule, follow the steps below.
1 In the Name field, specify a name for the rule. Valid values include
alphanumeric characters, periods (.), underscores (_), hyphens (-), and
spaces( ). The name cannot exceed 100 characters.
2 In the Protocol field, select the protocol type for the rule you are creating. (If
you selected TCP, UDP, or ICMP as the rule type, the Protocol field will be
automatically filled in for you.)
To create an IP Filter rule for a protocol that is not listed in the drop-down
list, manually type the protocol number in the Protocol field.
3 In the Action field, specify the action that should occur when a packet
matches this rule:
• Allow—The packet will be translated or redirected, as defined in the
Source/Dest tab and will then continue regular kernel-level processing.
• Deny—The packet will be rejected without further filtering.
• Bypass IP Filter Rules —The packet will bypass IP Filter processing
and go to the beginning of the proxy rule list. This option is generally
used for common proxy protocols, such as HTTP, and is recommended
as an optimization when you have a large number of IP Filter rules. This
action is not an option for Other rules.
4 In the Control field, select Enable to enable the rule or Disable to disable
the rule. This allows you to temporarily disable a rule, if necessary, without
deleting it. Rules that are disabled will appear grayed out in the main Rule
window.
5 In the Audit Level field, select the type of audit you want performed when a
packet matches this rule. The options vary depending on the rule action, as
follows:
• If Action = Allow, then:
– None—No audit information will be recorded for this rule.
– Informational—Select this option to generate errors, normal traffic,
and informational audit events for this rule.
– Traffic—Select this option to generate normal traffic and error audit
events for this rule.
– Errors Only—Select this option to generate only error audit events
for this rule. If you select this option, normal traffic will not be logged.
(This option increases performance and reduces the size of audit
logs.)
• If Action = Deny or Bypass IP Filter Rules, then:
– All—Select this option to generate audit events for all packets that
match this rule.
– Limit—Select this option to generate audit events for this rule at the
frequency specified in the IP Filter Properties window’s setting. See
“Viewing and modifying general IP Filter properties” on page 241 for
more information.
– None—No audit information will be recorded for this rule.