High-level steps for configuring Firewall policies

Pre-device — This resource is the Sensor itself, and the Firewall policy assigned to this resource is applied to all the traffic reaching the Sensor. This policy is referred to as the pre-device policy. A pre-device Firewall policy has the highest priority. That is, the Sensor matches the traffic against the access rules of this policy first. Typically, you will assign policies that will block specific traffic across your network. For example, you might want to block p2p traffic perpetually on your network.

Interface or subinterface — These resources are Monitoring ports of type VLAN or CIDR. You can assign Firewall policies to interfaces or subinterfaces based on how you have configured the Monitoring ports.

The Sensor considers the policy at the interface or subinterface after the policy assigned at the pre-device level. The Sensor enforces this policy only on the traffic seen at the corresponding interface or subinterface. So, typically you will assign policies that are very granular in nature in terms of source and destination. For example, these could be policies targeted at specific hosts or networks.

Physical port level — Assign those policies that you want to enforce at a port level. Typically, these policies will be less granular when compared to the policies assigned at the interface or subinterface level. The Sensor considers the policy at this level after the policy at the interface or subinterface.

Post-device — This resource is also the Sensor itself, similar to pre-device. However, the post-device policy is applied only after all the policies assigned to the other Sensor resources.

You can have a unique Firewall policy to each Sensor resource, but only one Firewall policy per resource. It is not mandatory to assign Firewall policies to Sensor Resources in any specific order. For example, you can assign a policy only at the pre-device level or only at the subinterface level.

Policies assigned at the Sensor level (pre and post-device) as well as the port/port pair are inherited by the corresponding interface and, if applicable, subinterfaces. In the case of Firewall policies, an interface is a subset of the corresponding port or port pair. That is, the policy assigned for a port/port pair at the Sensor level is inherited by the corresponding interface as well as any subinterfaces. However, a policy assigned at the interface level is not inherited by the corresponding subinterfaces due to the rule of separating interface traffic flows from subinterface traffic flows based on the following policy application rule: if you apply a policy to a subinterface that is different than the inherited policy, the policy enforced at the interface level protects all traffic not specific to the subinterface. Thus, for Firewall policies, the rule of inheritance requires you to create global policies at the Sensor (pre and post-device) or physical port/port pair level: interface policies only apply to interfaces, and subinterface rules only apply to subinterfaces.

After you assign the Firewall policies, the Manager creates a collective list of all the access rules in those policies. This is the list of Effective Rules that the Sensor processes in a top-down fashion. That is, the rule at the top of the list is checked first, followed by subsequent rules down to the bottommost rule. Trellix IPS employs a first-match process; the first rule matched in sequence is enforced and the remaining rules are not processed.

The order of the rules in an Effective Rules list is based on the hierarchy of Sensor resources. That is, the rules of the pre-device Firewall policy are listed on top followed by the rules of the interface or subinterface policy, then followed by the port-level policy, and finally the post-device level policy.

Note

The Manager computes the Effective Rules separately for inbound and outbound.

You can view the Effective Rules in the Policy Manager page at the interface and sub-interface levels.