ZyXEL Communications ZyWall 110 User Manual page 374

Security firewalls

Hide thumbs Also See for ZyWall 110:

Table of Contents

Figure 252 Blocking All LAN to WAN IRC Traffic Example

Your Security Policy would have the following settings.

Table 158 Blocking All LAN to WAN IRC Traffic Example

• The first row blocks LAN access to the IRC service on the WAN.

• The second row is the Security Policy's default policy that allows all LAN1 to WAN traffic.

The ZyWALL/USG applies the security policies in order. So for this example, when the ZyWALL/USG

receives traffic from the LAN, it checks it against the first policy. If the traffic matches (if it is IRC

traffic) the security policy takes the action in the policy (drop) and stops checking the subsequent

security policies. Any traffic that does not match the first security policy will match the second

security policy and the ZyWALL/USG forwards it.

Now suppose you need to let the CEO use IRC. You configure a LAN1 to WAN security policy that

allows IRC traffic from the IP address of the CEO's computer. You can also configure a LAN to WAN

policy that allows IRC traffic from any computer through which the CEO logs into the ZyWALL/USG

with his/her user name. In order to make sure that the CEO's computer always uses the same IP

address, make sure it either:

• Has a static IP address,

• You configure a static DHCP entry for it so the ZyWALL/USG always assigns it the same IP

Now you configure a LAN1 to WAN security policy that allows IRC traffic from the IP address of the

CEO's computer (172.16.1.7 for example) to go to any destination address. You do not need to

specify a schedule since you want the security policy to always be in effect. The following figure

shows the results of your two custom policies.

Chapter 21 Security Policy

ZyWALL/USG Series User's Guide

Show Quick Links

Table of Contents

Troubleshooting