Symantec™ Security Gateways Reference Guide - Sawmill

Understanding accessRules65Similar to rules themselves, the rule parameters also have a priority as to which takes precedence. Forsimilarly configured rules, the following order is checked:■■■■■■■■Rules that define a time period (WorkingHours, for example) take precedence over those with nodefined time period () when the connection request arrives during that time period. If theconnection request arrives outside of the defined time period (trying to access the network on theweekend when WorkingHours is defined, for example), then the rule with takesprecedence.Rules with more source network bits defined rank higher than those with fewer. Therefore, a rulespecific to a host is picked before a rule that defines a subnet, and both of these are chosen before a rulethat uses the *universe entity. In cases where there is no difference between the number of networkbits, entity names are used, with longer names taking priority over shorter ones.Rules with source interface restrictions (eth0, eth1, and so forth) have a higher priority than those withno interface restrictions.Rules with more destination network bits defined rank higher than those with fewer. Therefore, a rulespecific to a host is picked before a rule that defines a subnet, and both of these are selected before arule that uses the *universe entity. In cases where there is no difference between the number of networkbits, entity names are used, with longer names taking priority over shorter ones.Rules with destination interface restrictions (eth0, eth1, and so forth) are higher in priority than thosewith no interface restrictions.Rules that explicitly deny traffic supersede matching rules.Rules with user restrictions overrule those with no restrictions.Rules with authentication override those with no authentication.This order also defines top-down priority. That is, a rule with a time period takes precedence over a similarrule with authentication.Rules with groupsThe security gateway treats rules with groups as a concatenation of rules using the members of the group.If you have a group with a host entity and a subnet entity and another rule with the same host entity, thetwo rules have the same priority when evaluating a connection attempt with respect to the host entity. Thefirst rule to appear in the list is the one the security gateway uses. In the case of equivalent rules, thesecurity gateway logs a message indicating the rule it applied. In this case, the order of the rules in theconfiguration file is significant. You should periodically review your group entities to ensure that there areno conflicts.Note: Unless you desire to build all rules with the Universe entity (all addresses) as both the source anddestination (not advisable), you must create network entities for the specific host or hosts you wish toallow.Rule authenticationUnless it’s the Universe entity, it is not advisable to create an allow rule based only on where the requestoriginates. Rules should have some authentication or extended authentication requirement in addition tomatching the source and destination addresses. You can spoof source addresses, and without verifying theuser’s credentials, you have no guarantee that the user connecting is really who they say they are. Addingan authentication requirement to a rule lets the administrator instruct the connecting user to identifythemselves and prove they should have access.