WORKING WITH THE SMARTDASHBOARD

WORKING WITH THE SMARTDASHBOARD
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Objectives
Key Term
. . . . .
5
VPN-1/FireWall-1 gives you the ability to manipulate how you view your Rule
Base, by:
• Masking (hiding) rules
Viewing hidden rules
Disabling rules
In addition to hiding and unhiding rules, VPN-1/FireWall-1 allows you to
perform the following:
Install and uninstall a Security Policy
Improve VPN-1/FireWall-1 performance via a Security Policy
1 Demonstrate how to perform the following:
Hide and unhide rules
View hidden rules
Define a rule mask
Apply rule masks
2 Show how to install and uninstall a Security Policy
3 List the guidelines for improving VPN-1/FireWall-1 performance, using a Security
Policy.
Masking rules
129
Chapter 5

5
Overview
130
WORKING WITH THE SMARTDASHBOARD
Masking Rules
MASKING RULES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
During Rule Base maintenance or troubleshooting, you can make viewing a
Rule Base easier by hiding rules you do not want to see. This is called masking
rules. Masking rules is useful for viewing a few rules, without being distracted
by other rules. These masked or hidden rules remain part of the Rule Base, and
are installed when the Security Policy is installed. To hide a rule or rules, first
select the rule(s), then select the Rules > Hide option from the menu bar.
When hiding individual rules, all other rules remain visible, but
their rule numbers do not change.
Viewing Hidden Rules
If View Hidden in the Rules > Hide menu is checked, then all rules selected as
hidden are displayed in the Rule Base, together with the other rules.
A thick, grey, horizontal line indicates the presence of hidden rules.
Hidden Rules not Displayed
Whether they are displayed or not, hidden rules are enforced
when the Security Policy is installed.

WORKING WITH THE SMARTDASHBOARD
Masking Rules
. . . . .
When they are revealed, rules set as hidden are colored differently from other
rules. Different coloring makes it easy to identify rules set as hidden, when
those rules are revealed.
Hidden Rule Displayed
Revealing Hidden Rules
To remove the hide setting for all hidden rules, select Unhide All from the
Rules > Hide menu.
131

5
Disabling a Rule
132
WORKING WITH THE SMARTDASHBOARD
Disabling and Enabling Rules
DISABLING AND ENABLING RULES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
When you disable a rule, it is not disabled until the Security Policy is installed.
The rule remains in the Rule Base, and can be enabled later. This is useful for
testing and troubleshooting firewall issues. To disable rules, follow these steps:
1 Disable all rules suspected of causing the issue.
2 Reinstall your Security Policy.
3 Test to see if disabling rules solves the issue.
4 Enable rules one at a time, to see which rule is causing the issue.
5 Reinstall the Security Policy.
Do not forget to reinstall your Security Policy after
disabling/enabling any rules!
To disable a rule, follow these steps:
1 Right-click the selected rule’s number, and select Disable Rule.
2 Save and install the Security Policy.
When a rule is disabled, a large red “X” is displayed over its rule number.
Disabled Rule

Enabling a Disabled Rule
To enable a disabled rule, follow these steps:
WORKING WITH THE SMARTDASHBOARD
Disabling and Enabling Rules
1 Select the disabled rule by Right-clicking on its number, and selecting Disable
Rule (to deselect).
2 Save and reinstall the Security Policy.
Adding Section Titles
Large rule bases can be organized into groups of rules to make administration
easier. A title can be added to indicate the rule group. To add a section title:
1 Select Rules from the Menu, and choose Add Section Title.
2 Select the Title placement, above or below the rule.
3 Type the Header information, and click OK.
Section Titles
. . . . .
133

5
134
WORKING WITH THE SMARTDASHBOARD
Uninstalling a Security Policy
UNINSTALLING A SECURITY POLICY
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The Uninstall Security Policy screen lists all internal firewalled hosts and
routers. By default, all internal firewalled hosts and routers are already selected.
To uninstall a Security Policy, use the following steps:
1 Click Policy > Uninstall from the Security SmartDashboard main screen.
2 Click Select All, to select all the items in the screen. You may clear specific items.
The Security Policy will not be removed from cleared items.
The Uninstall Policy screen
3 Click OK to uninstall the Security Policy.
4 Once the Close button appears, click Close, to return to the SmartDashboard.
When the Security Policy is uninstalled, traffic will not pass
through the Enforcement Modules. Also, the gateways are
exposed without having a Security Policy installed.

SmartCenter Server
Enforcement Module
WORKING WITH THE SMARTDASHBOARD
Improving VPN-1/FireWall-1 Performance
. . . . .
IMPROVING VPN-1/FIREWALL-1
PERFORMANCE
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Installation time for creating network objects can often be decreased by listing
machine names and IP addresses in the hosts files:
(Solaris) /etc/hosts
(Windows) \winnt\system32\drivers\etc\hosts
VPN-1/FireWall-1 performance depends on hardware, the Security Policy, and
the characteristics of network traffic. While the enforcement Module is
inspecting packets, the amount of time a packet spends in the kernel increases.
The conclusion is that VPN-1/FireWall-1 has an impact on latency, and
connection or transaction latency, has less impact on bandwidth.
The following suggestions are guidelines for improving performance of
Security Policies:
1 Keep the Rule Base simple. Performance degrades with a very large number of
rules, or when the rules are complex.
2 Try to position the most frequently applied rules near the top of the Rule Base.
The firewall reads the Rule Base in order, so putting the most frequently applied
rules first will speed up the process. For example, if most connections are HTTP
packets, the rule that accepts HTTP should be near the top of the Rule Base. Be
sure to keep this rule as simple as possible. Client Authentication rules should
always be placed before the Stealth Rule, as they need direct access to the
firewall.
3 Do not log unnecessary connections.
4 Use a network object in place of many workstation node objects.
5 Use IP address ranges in rules, instead of a set of workstation nodes (address
ranges are discussed in the NAT chapter)
135

5
136
WORKING WITH THE SMARTDASHBOARD
Improving VPN-1/FireWall-1 Performance