Network Security, Access Control, and Policy
Rule order and defaults
MX Layer 3 firewall rules evaluate top-down with first match wins. Outbound traffic is allowed by default when no rule matches; inbound traffic is denied by default. That asymmetry is the single most tested fact in this domain: a deny rule must be placed above the broader allow rule it is meant to override.
Layers of control
- MX L3/L7 firewall: L7 rules match on category or application and apply to outbound flows only.
- Content filtering, AMP, and IPS: delivered through group policies; the most specific policy wins.
- Switching: DHCP snooping, dynamic ARP inspection, IP source guard, and sticky-MAC port security.
- Wireless: WPA2/WPA3-PSK versus 802.1X with RADIUS, MAC allow lists, and splash pages.
- Client policies: a group policy bound to a client overrides the network-wide default for that client.
Traps
Confusing SSID firewall rules (wireless clients only) with MX L3 rules (all clients). Assuming an implicit outbound "deny any" exists. Assuming L7 rules can block inbound traffic. Forgetting that a per-client policy beats the network default.
Rule of thumb: read every firewall question as "who is the source, which direction, which layer" - the direction usually decides the answer.
Worked example: to block outbound DNS to a public resolver, create an L3 outbound rule with source = LAN, destination = the resolver IP, protocol UDP/53, action deny, placed above any broader allow rule.