Configuring firewall policies (Edge)

Just like on the hub, the firewall policies control and secure what traffic is permitted, and from which source and to which destination.

Following is a summary of how to configure firewall policies:

1. Create a new policy package for Edge devices and assign it to the Edge group. See Creating a new policy package.
2. Configure 3 rules for the edge devices. See Creating rules.

Creating a new policy package

To create a new policy package:

1. In Policy & Objects, create a new Policy Package called Edge, and add the Device Group Edge to its installation targets:

   

Creating rules

To create rules

1. Create the following Firewall Policy:

   Name	From	To	Src	Dst	Service	NAT	Action
   Corporate	lan overlay	lan overlay	CORP_LAN	CORP_LAN	ALL	No	Accept
   Internet (DIA)	lan	underlay	all	all	ALL	Yes	Accept
   Internet (RIA)	lan	overlay	all	all	ALL	No	Accept

   

   Notes:

   • The SD-WAN Zones underlay and overlay were automatically created to be used in the Firewall Policy
   • The Firewall Policy distinguishes between Direct Internet Access (DIA, from the Edge itself) and Remote Internet Access (RIA, via the Hub), potentially applying different security features in each case. One common example shown above is Source NAT which is only applied to the traffic using DIA.
   • It is highly recommended to enable Application Control, especially on the Firewall Policy controlling Internet traffic. For accurate application identification, it is also highly recommended to enable SSL Inspection. This functionality is required for SD-WAN Application-aware traffic steering and is also used to populate SD-WAN widgets and reports.