Firewall Technologies and Policy Configuration
Stateful inspection and sessions
USG is a stateful firewall: the first packet of a flow is checked against the security policy and a session entry is created. Return traffic matches the session, not the policy. display firewall session table is the first troubleshooting command. ASPF/ALG handles multi-channel protocols such as FTP, SIP and PPTP by opening predicted channels.
Security policy structure
A policy matches source zone, destination zone, source address, destination address, service or application, user, and time range. Rules are evaluated top-down, first match wins, and the default interzone action is deny. More specific policies go above general ones. Application identification can match an app even when it uses port 80.
Policy workflow
- Define address objects and services, or use predefined ones.
- Create the interzone policy with the narrowest match.
- Place it above broader permit rules.
- Verify hit counts and sessions.
Worked example
Trust to Untrust must allow only HTTP and HTTPS to partner site 203.0.113.0/24 and block all other internet access. Reasoning: create a permit policy for destination 203.0.113.0/24 with service HTTP,HTTPS, then a deny policy Trust to Untrust any. Because first match wins, the deny must sit below the permit. If users report failure, check the session table and policy hit count before assuming a routing fault.
Traps that cost marks
- Putting a broad permit above a specific deny.
- Forgetting that service any includes risky applications.
- Expecting a policy change to affect existing sessions; sessions persist until aged out, so reset them.
- Confusing service (port and protocol) with application (decoded protocol).