Hub Policy Package
To create the Hub Policy Package interactively:
-
In Policy & Objects, navigate to Policy Packages. Click Policy Package > New and create a package named Hub.
-
Under Installation Targets of the newly created Hub package, click Edit and assign the package to the Hubs device group.
-
Under Firewall Policy, click Create New to create the following firewall rules. For all rules, set Action to Accept:
Name
From
To
Src
Dst
Service
NAT
Edge-Edge
overlay
hub2hub_overlay
overlay
hub2hub_overlay
CORP_LAN
CORP_LAN
ALL
No
Edge-Hub
lan_zone overlay
hub2hub_overlay
lan_zone overlay
hub2hub_overlay
CORP_LAN
CORP_LAN
ALL
No Internet (DIA)
lan_zone
underlay
all
all
ALL
Yes
Internet (RIA)
overlay
underlay
all
all
ALL
Yes Health-Check
overlay
Lo-HC
all
all
PING
No
Peering
overlay
hub2hub_overlay
Lo
all
all
PING
BGP
No
-
In the Edge-Edge rule, configure the following Advanced Options:
Parameter
Value
anti-replay
off
tcp-session-without-syn
all
Keep in mind that Edge-to-Edge traffic will be already secured by the Spokes. Hence, there is no need to repeat the same inspection on the Hub, especially considering that most of the Edge-to-Edge traffic will not even transit the Hub. It will use direct ADVPN shortcuts instead.
Furthermore, if network conditions change, the traffic could switch to another overlay and reach the Hub in the middle of the TCP session. In order to avoid traffic drop in this situation, the above Advanced Options are necessary. Note that they do not compromise the security, because this Edge-to-Edge traffic is already fully inspected by the Spokes, both when the traffic flows through the Hub and when it doesn't.
Notes:
-
Just like the Spokes, we are using System Zones and SD-WAN Zones to keep the policy package generic. There is one additional System Zones here (
hub2hub_overlay) for the Hub-to-Hub overlays that interconnect different regions. Our Jinja Templates will configure it on the Hub devices. -
This Policy Package is ready to support Remote Internet Access where traffic arriving from the Edge devices through the overlays is directed to the Internet (underlay).
-
This Firewall Policy also allows Direct Internet Access for the workloads hosted behind the Hub itself.
-
We must explicitly allow health-check probes that the Spokes will send to the Hubs, as it is done in the Health-Check rule.
-
We must also explicitly allow incoming BGP sessions from the Spokes and from the Hubs serving remote regions. (In the "BGP on Loopback" design, all these BGP sessions will be terminated on the main loopback interface "Lo".) This is done in the Peering rule.
In the "BGP per Overlay" design, only the inter-regional (Hub-to-Hub) BGP peering is terminated on the loopback interface. Hence, only the hub2hub_overlay zone is required in this rule.