ZyXEL Communications USG40 User Manual page 338

• The second row is the Security Policy's default policy that allows all LAN1 to WAN traffic.
The ZyWALL/USG applies the security policies in order. So for this example, when the ZyWALL/USG
receives traffic from the LAN, it checks it against the first policy. If the traffic matches (if it is IRC
traffic) the security policy takes the action in the policy (drop) and stops checking the subsequent
security policies. Any traffic that does not match the first security policy will match the second
security policy and the ZyWALL/USG forwards it.
Now suppose you need to let the CEO use IRC. You configure a LAN1 to WAN security policy that
allows IRC traffic from the IP address of the CEO's computer. You can also configure a LAN to WAN
policy that allows IRC traffic from any computer through which the CEO logs into the ZyWALL/USG
with his/her user name. In order to make sure that the CEO's computer always uses the same IP
address, make sure it either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the ZyWALL/USG always assigns it the same IP
address.
Now you configure a LAN1 to WAN security policy that allows IRC traffic from the IP address of the
CEO's computer (172.16.1.7 for example) to go to any destination address. You do not need to
specify a schedule since you want the security policy to always be in effect. The following figure
shows the results of your two custom policies.
Figure 225 Limited LAN to WAN IRC Traffic Example
Your security policy would have the following configuration.
Table 140 Limited LAN1 to WAN IRC Traffic Example 1
# USER SOURCE
1 Any 172.16.1.7
2 Any Any
3 Any Any
• The first row allows the LAN1 computer at IP address 172.16.1.7 to access the IRC service on the
WAN.
• The second row blocks LAN1 access to the IRC service on the WAN.
• The third row is the default policy of allowing all traffic from the LAN1 to go to the WAN.
Alternatively, you configure a LAN1 to WAN policy with the CEO's user name (say CEO) to allow IRC
traffic from any source IP address to go to any destination address.
Chapter 18 Security Policy
DESTINATION
Any
Any
Any
ZyWALL/USG Series User's Guide
338
SCHEDULE UTM PROFILE
Any IRC
Any IRC
Any Any
ACTION
Allow
Deny
Allow