Firewall Rule Building

[b_harvey92]

Hi All,

I have a task to create some rules for a Firewall that is in production and currently does not have any rules on the Firewall.

I've managed to look onto the Firewall and see the top protocols going through the Firewall and generic protocols being used, eg: HTTP/HTTPS. But I wondered if anyone had any tips as to a way to build rules and to not end up blocking any traffic!

Thanks in advance!

Ben

[Marvin Rhoads]

I've used Netflow to export all the flows and used analysis of that data set as a basis to create rules.

You can use a free flow collector/analyzer like ntop or a trial version of one of the commercial ones like SolarWinds NTA, ManageEngine or PRTG's free version.

[Pulkit Saxena]

Ben,

I think this pretty much required manual effort, since we need to ensure that we do not block legitimate traffic. "show conn detail" output can help from the device to provide top talkers but again even those who are making less connections can be legitimate.

I think, from "inside" to "outside", you are going to allow most of the traffic, care needs to be taken from "outside" to "inside" where you will be allowing access to only your public facing servers, corresponding to NAT statements.

Regards,

Pulkit