Filter
Top Products
DFL-500 User Manual
2
5
You can also select Insert Policy before on a policy in the list to add the new policy above a
specific policy.
•
Configure the policy:
Source
Select an address or address group that matches the source address of the packet. Before you
can add this address to a policy, you must add it to the source interface. To add an address, see
Addresses
.
Destination
Select an address or address group that matches the destination address of the packet. Before
you can add this address to a policy, you must add it to the source interface. To add an address,
see Addresses
.
For an Ext -> Int NAT mode policy, the destination can also be a virtual IP that maps the
destination address to a hidden destination address on the internal network. See Virtual IPs
.
Schedule
Select a schedule that controls when the policy is available to be matched with connections. See
Schedules
.
Service
Select a service that matches the service (or port number) of the packet. You can select from a
wide range of predefined services or add custom services and service groups. See Services
.
Action
Select how the firewall should respond when the policy matches a connection attempt.
ACCEPT
Accept the connection. If you select ACCEPT, you can also configure NAT and Authentication for
the policy.
DENY
Deny the connection.
ENCRYPT
Make this policy an IPSec VPN policy. If you select ENCRYPT, you can select an AutoIKE key or
Manual Key VPN tunnel for the policy and configure other IPSec settings. For ENCRYPT policies,
service is set to ANY and authentication is not supported
NAT
Configure the policy for NAT. NAT translates the source address and the source port of packets
accepted by the policy. If you select NAT, you can also select Dynamic IP Pool and Fixed Port.
Dynamic IP
Pool
Select Dynamic IP Pool to translate the source address to an address randomly selected from an
IP pool added to the destination interface of the policy. To add IP pools, see IP pools
.
You cannot select Dynamic IP Pool for Int -> Ext policies if the external interface is configured
using DHCP or PPPoE.
Fixed Port
Select Fixed Port to prevent NAT from translating the source port. Some applications do not
function correctly if the source port is changed. If you select Fixed Port, you must also select
Dynamic IP Pool and add a dynamic IP pool address range to the destination interface of the
policy. If you do not select Dynamic IP Pool, a policy with Fixed Port selected can only allow one
connection at a time for this port or service.
VPN Tunnel
Select a VPN tunnel for an ENCRYPT policy. You can select an AutoIKE key or Manual Key
tunnel.
Allow
inbound
Select Allow inbound so that users behind the remote VPN gateway can connect to the source
address.
Allow
outbound
Select Allow outbound so that users can connect to the destination address behind the remote
VPN gateway.
Inbound
NAT
Select Inbound NAT to translate the source address of incoming packets to the DFL-500 NPG
internal IP address.
Outbound
NAT
Select Inbound NAT to translate the source address of outgoing packets to the DFL-500 NPG
external IP address.
Log Traffic
Select Log Traffic to write messages to the traffic log whenever the policy processes a connection.
Authentication
Select Authentication and select a user group to require users to enter a user name and password
before the firewall accepts the connection. Select the user group to select the users that can
authenticate with this policy. To add and configure user groups, see Users and authentication
. You
must add user groups before you can select authentication.
You can select Authentication for any service. Users can authenticate with the firewall using HTTP,