topic Re: SFR access control policy in Network Security

SFR access control policy

adamgibs7 — Fri, 21 Feb 2020 15:41:05 GMT

Dears,

you may be thinking what I am speaking is not logic but it is happening with me

Problems:

I have exempted certain mangers from restrictions and they are hitting to the proper policy and things are working fine, as soon as I make a additional policy for deny any any from inside to outside zone , managers and users traffic starts hitting the deny policy and things get blocked,

Please find the attached error is it this error is making a problem.

Re: SFR access control policy

yogdhanu — Mon, 30 Apr 2018 08:04:19 GMT

The error screenshot and problem seems not connected.

The error that you get may be because a Realm for which some user based rules were created are there in the access control policy but the realm is already deleted.

You would need to delete the reference user based rules from ACP which point to deleted realm.

I assume with this error, you cannot deploy policy. With that, creating a deny rule should not affect anyone because the rules are not deployed.

May be I didn't get the problem right.

Hope this helps,

Yogesh

Re: SFR access control policy

adamgibs7 — Mon, 30 Apr 2018 19:24:34 GMT

Dear Yogdhanu,

the rules get deployed and they become active even by the hit counts this means the error is not affecting.

I have only one relam and no such user groups are deleted on daily basis hence I was mentioning the managers rule in which I am calling the managers their group has not changed from many years

thanks

Re: SFR access control policy

yogdhanu — Tue, 01 May 2018 07:36:24 GMT

Can you share the actual rules screenshot?

Or may be do system support firewall-engine debug or system support trace (if above 6.2) and check how the traffic is matched against the rules. That would give us some more idea on whats happening.