121
Tutorial 2: Protecting Your Network
These sections cover configuring the USG to protect your network.
2.1 Firewall
The firewall controls the travel of traffic between or within zones for services using static port
numbers. Use application patrol to control services using flexible/dynamic port numbers. The firewall
can also control traffic for NAT (DNAT) and policy routes (SNAT). Firewall rules can use schedule, user,
user groups, address, address group, service, and service group objects. To-USG firewall rules control
access to the USG itself including management access. By default the firewall allows various types of
management from the LAN, HTTPS from the WAN and no management from the DMZ. The firewall
also limits the number of user sessions.
This example shows the USG’s default firewall behavior for WAN to LAN traffic and how stateful
inspection works. A LAN user can initiate a Telnet session from within the LAN zone and the firewall
allows the response. However, the firewall blocks Telnet traffic initiated from the WAN zone and
destined for the LAN zone. The firewall allows VPN traffic between any of the networks.
Figure 28 Default Firewall Action
To Next Page
Loading...
