You can add custom lists, feeds and Threat Insight, and category filters to your policy rules. Depending on your business requirements, you can add as many feeds and Threat Insight, custom lists or category filters as you need and apply them to different security policies. Note that you must first define a custom list or a category filter before you can add it to the security policy. For information about how to create a custom list, see Creating Custom Lists. For information about how to add category or application filters, see Configuring Filters.
To add policy rules, apply actions, and set precedence, complete the following:
On the Policy Rules page of the Create New Security Policy wizard, define the Default Action for all the destinations that you have not included in the security policy, as follows:
- Allow: Grants traffic access to a domain or IP address that hits a particular feed or security policy.
- Default Redirect: Routes traffic to the default Infoblox page or a custom message that you have configured for the Redirect Page.
- Custom Redirect: Redirects to a configured custom redirect, if one has been configured by the organization.
- Click the Add Rule menu and choose one of the following policy types.
Note
When you choose a policy type, the system adds it to the table. You can perform the following for each rule:
- Click Select List to view available rules for the respective policy type.
- Click the Action menu to set the action for each policy rule. For more information about what each action means, see About Rule Actions.
- Set the precedence order for a policy rule by clicking the up and down arrows at the end of each row to move the rule to its desired rank. The system applies policy rules based on the precedence order. Although you have the flexibility to set precedence for each rule, it is important that you understand the ramification of putting certain policy rules before others. For more information, see Security Policy Precedence.
- Choose a policy rule and click Remove to remove it from the list.
- Custom List: Choose this to add a custom list to the policy. When you click a custom list, you can view the Threat Level and Threat Confidence. When you are ready, click Select to add the custom list to the policy. Custom lists can be either allow lists or block lists, depending on the actions that you set upon them.
Action Types: Select an action type from among the action options under the ACTION menu to add to your security policy. Options include the following:
- Allow - No Log: Allows custom list filtering without logging of responses.
- Allow - With Log: Allows custom list filtering with logging of responses.
- Block - No Redirect: Blocks custom list filtering when using no redirection.
- Block - Default Redirect: Blocks custom list filtering when using the default redirect.
- Block - Redirect: Blocks custom list filtering when using a custom redirect.
- Block (No Log) - No Redirect: Blocks custom list filtering without logging of responses when using no redirection.
- Block (No Log) - Default Redirect: Blocks custom list filtering without logging of responses when using the default redirect.
- Block (No Log) - Redirect: Blocks custom list filtering without logging of responses when using a custom redirect.
- Custom List: Choose this to add a custom list to the policy. When you click a custom list, you can view the Threat Level and Threat Confidence. When you are ready, click Select to add the custom list to the policy. Custom lists can be either allow lists or block lists, depending on the actions that you set upon them.
You can also add a custom list by clicking on the Custom List option from among the Choose a Custom List drop-down menu options. To create your custom list, you must provide a name for the custom list. A description for the custom list is optional. Select a level (INFO, LOW, MEDIUM, or HIGH) to be used to label indicators as a means of classifying the threat level to your organization. By selecting a threat level, you can select or override the threat level provided by Infoblox. Select a confidence level (HIGH, MEDIUM, or LOW) to be used to label indicators as a means of classifying the threat level to your organization. By selecting a confidence level, you can select or override the threat level provided by Infoblox.
For more information about custom lists, see Custom Lists.
- Feeds and Threat Insight: Choose this to add a feed or Threat Insight to the policy. Your custom TIDE feeds (TIDE Bring Your Own Feed or TIDE BYOF) are listed under the list of available feed options. When you click a feed or Threat Insight, you can view the Threat Level and Threat Confidence. When you are ready, click Select to add the feed or Threat Insight to the policy. Feeds and threat insight can be either allow lists or block lists, depending on the actions that you set upon them.
Action Types: Select an action type from among the action options under the ACTION menu to add to your security policy. Options include the following:
- Allow - No Log: Allows feeds and threat insight filtering without logging of responses.
- Allow - With Log: Allows feeds and threat insight filtering with logging of responses.
- Block - No Redirect: Blocks feeds and threat insight filtering when using no redirection.
- Block - Default Redirect: Blocks feeds and threat insight filtering when using the default redirect.
- Block - Redirect: Blocks feeds and threat insight filtering when using a custom redirect.
- Block (No Log) - No Redirect: Blocks feeds and threat insight filtering without logging of responses when using no redirection.
- Block (No Log) - Default Redirect: Blocks feeds and threat insight filtering without logging of responses when using the default redirect.
- Block (No Log) - Redirect: Blocks feeds and threat insight filtering without logging of responses when using a custom redirect.
- Feeds and Threat Insight: Choose this to add a feed or Threat Insight to the policy. Your custom TIDE feeds (TIDE Bring Your Own Feed or TIDE BYOF) are listed under the list of available feed options. When you click a feed or Threat Insight, you can view the Threat Level and Threat Confidence. When you are ready, click Select to add the feed or Threat Insight to the policy. Feeds and threat insight can be either allow lists or block lists, depending on the actions that you set upon them.
For more information, see Viewing Active Threat Feeds and Threat Insight.
- Category Filter: Choose this to add a category filter to the policy. Choose a category filter and click Select to add the category filter to the policy. Category filters are content categorization rules that allow you to detect and filter internet content and traffic that you want to allow or block. Choose the name of the category from among the Select List options under the NAME menu to add to your security policy.
Action Types: Select an action type from among the action options under the ACTION menu to add to your security policy. Options include the following:
- Allow - No Log: Allows category filtering without logging of responses.
- Allow - With Log: Allows category filtering with logging of responses.
- Block - No Redirect: Blocks category filtering when using no redirection.
- Block - Default Redirect: Blocks category filtering when using the default redirect.
- Block - Redirect: Blocks category filtering when using a custom redirect.
- Block (No Log) - No Redirect: Blocks category filtering without logging of responses when using no redirection.
- Block (No Log) - Default Redirect: Blocks category filtering without logging of responses when using the default redirect.
- Block (No Log) - Redirect: Blocks category filtering without logging of responses when using a custom redirect.
- Category Filter: Choose this to add a category filter to the policy. Choose a category filter and click Select to add the category filter to the policy. Category filters are content categorization rules that allow you to detect and filter internet content and traffic that you want to allow or block. Choose the name of the category from among the Select List options under the NAME menu to add to your security policy.
You can also add a custom category filter by clicking on the New Filter option from among the Choose Application Filter drop-down menu options. To create your custom category filter, you must provide a name for the custom category list. A description for the category filter list is optional.
For more information, see Creating Category Filters.
Application Filter: Choose this to add an application filter to the policy. Choose an application filter and click Select to add the application filter to the policy. Application filters are application categorization rules that allow you to detect and filter internet content and traffic that you want to allow or block. Choose the name of the application from among the Select List options under the NAME menu to add to your security policy.
Action Types: Select an action type from among the action options under the ACTION menu to add to your security policy. Options include the following:
- Allow - No Log: Allows application filtering without logging of responses.
- Allow - With Log: Allows application filtering with logging of responses.
- Allow - Local Resolution: Allows application filtering when used with local on-prem relocation.
- Block - No Redirect: Blocks application filtering when using no redirection.
- Block - Default Redirect: Blocks application filtering when using the default redirect.
- Block - Redirect: Blocks application filtering when using a custom redirect.
- Block (No Log) - No Redirect: Blocks application filtering without logging of responses when using no redirection.
- Block (No Log) - Default Redirect: Blocks application filtering without logging of responses when using the default redirect.
- Block (No Log) - Redirect: Blocks application filtering without logging of responses when using a custom redirect.
You can also add a custom application filter by clicking on the New Filter option from among the Choose Application Filter drop-down menu options. To create your custom application filter, you must provide a name for the custom application list. A description for the custom list is optional.
For more information, see Creating Application Filters.
Precedence reordering: You can reorder security policy rules precedence using drag-and-drop functionality. Click on the policy rule to be reordered on the Policy Rules page and drag it to its new location. Repeat the process as necessary until all policy rules precedence have been reordered as required.
- After you add policy rules, set actions, and precedence, you can proceed to add bypass codes.
- Click Next in the wizard to add bypass codes. For more information, see Adding Bypass Codes to a Security Policy.
For information about other tasks in creating a new security policy, see the following: