Specifications

Network and System Management
333
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308
Each rule lets you specify the desired action for the connections covered by the rule:
• BLOCK always
• BLOCK by schedule, otherwise allow
• ALLOW always
• ALLOW by schedule, otherwise block
The following section summarizes the various criteria that you can apply to inbound rules and
that might increase traf
fic. For more information about inbound rules, see
Inbound Rules
(Port Forwarding) on page 140. For detailed procedures on how to configure inbound rules,
see Configure LAN WAN Rules on page 145 and Configure DMZ WAN Rules on page 152.
When you define inbound firewall rules, you can further refine their application according to
the following criteria:
• Services. Y
ou can specify the services or applications to be covered by an inbound rule.
If the desired service or application does not display in the list, you need to define it using
the Services screen (see Inbound Rules (Port Forwarding) on page 140 and Add
Customized Services on page 177).
• WAN destination IP address. You can specify the destination IP address for incoming
traf
fic. Traffic is directed to the specified address only when the destination IP address of
the incoming packet matches the IP address of the selected WAN interface.
• LAN users (or DMZ users). Only when the IPv4 routing mode is Classical Routing, you
can specify which computers on your network are affected by an inbound rule. When
Classical Routing is enabled, there are several options:
- Any.
The rule applies to all computers and devices on your LAN or DMZ.
- Single address. The rule applies to the address of a particular computer
.
- Address range
. The rule applies to a range of addresses.
- Groups
. The rule is applied to a group of computers. (You can configure groups for
LAN W
AN outbound rules but not for DMZ WAN outbound rules.) The Known PCs
and Devices table is an automatically maintained list of all known computers and
network devices and is generally referred to as the network database, which is
described in Manage the Network Database on page 97. Computers and network
devices are entered into the network database by various methods, which are
described in Manage IPv4 Groups and Hosts (IPv4 LAN Groups) on page 96.
- IP Groups.
The rule applies to a group of individual LAN IP addresses. Use the IP
Groups screen (under the Network Security main navigation menu) to assign IP
addresses to groups. For more information, see Create IP Groups
on page 179. (LAN
IP groups do not apply to DMZ WAN inbound rules.)
• WAN users. Y
ou can specify which Internet locations are covered by an inbound rule,
based on their IP address:
- Any. The rule applies to all Internet IP address.
- Single address
. The rule applies to a single Internet IP address.