Creating Firewall Policies

To create a firewall policy, do the following:

1. In the Cloud Services Portal, click Manage > Service Edge > Policies > Firewall Policies.

2. Click Create.

3. On the Add New Firewall Policy dialog > General tab, specify the following:

Name: Enter a name for the policy. Create a name that does not exceed 64 characters in length. Use numbers, any special characters, uppercase and lowercase letters, and even spaces. Start and end a name with any character but not a space. Leading and trailing spaces will be trimmed off automatically.
Description: Describe the rule. This is optional.
Priority: Enter a number from 1 to 65. This is the priority in which the system processes the rule. The lower the number, the higher the priority.

To achieve the protection you want for your cloud infrastructure, be sure to assign the correct priority to each firewall policy.

To avoid unexpected behavior, do not create rules that are conflicting or have the same priorities. For example, if you create a rule that allows access to facebook.com, assign the rule a priority of 10, create a rule that denies access to facebook.com, and assign the second rule a priority of 10, then the system will process the rules in an undefined manner.

4. To create a firewall rule, complete the following:

Navigate to the Firewall Rules tab > Add Rule drop-down.
- Choose one of the following:
  - Block: Choose this to deny access for the configured traffic according to your setting.
  - Allow: Choose this to allow access for the configured traffic according to your settings.
  - Bypass DAF: Choose this to bypass DNS Assured Forwarding (DAF), which would normally block all configured traffic (not only DNS traffic) from accessing destinations that have not been resolved or validated by Infoblox DNS servers. Starting the DAF service on the edge will enable DAF and ensure that BloxOne Threat Defense policies are properly enforced even when DoH (DNS over HTTPS) and DoT (DNS over TLS) come into play. For more information, see DNS Assured Forwarding (DAF).
  - Copy Rule: Copy an existing rule to add it to the respective policy.
    1. Click Add.
    2. Select or search for the policy that contains the specific rule.
    3. Select the rule and click Add.
    4. Add more rules to the respective policy, or click Save to continue.
- Depending on the type of rule, specify the following:
  - Expand the Sources section, and choose one of the following:
    - Network: Choose this to add a specific network or network object that you have already configured. Click Add, and choose one of the following from the TYPE drop-down list:
      - ANY: No IP address is specified, so any address or device can be the source.
      - IP: To specify the source, enter a specific IP address in the VALUE field.
      - Address Object Groups: From the VALUE list, select the address object that you have already configured.
    - Tags: Choose this to add tags that you have already configured for BloxOne resources. Supported resources are IP Space, Address Block, Subnet, Range, Fixed Address, and IPv4 Reservation. You can then reference these resources in the rule, in the form of tags or as a direct resource object. For more information, see Managing Tags.
      - Click Add, and specify the following:
      - KEY: From the drop-down menu, choose the configured tag you want to add. All available tags are displayed in the menu.
      - VALUE: Choose the corresponding value from the drop-down menu for the selected tag. All available values are displayed in the menu. To add more tags to the rule, click Add again.

5. Click Next to move to the Summary tab, to ensure the policy is accurate.

6. Click Save & Close.