Configure prefilter rules

Configure prefilter rules to provide early blocking for unwanted traffic and to fast path traffic that does not benefit from access control inspection.

Use prefilter rules in a non-default prefilter policy to provide early blocking for unwanted traffic, and to fast path traffic that does not benefit from access control inspection.

If your device supports flow offload, fast path traffic is eligible for flow offload if it meets all other criteria. See Large flow offloads.

Before you begin

You cannot create rules in the default prefilter policy. If you have not created a custom prefilter policy, do so now.

Procedure

Step 1

Choose Policies > Security policies > Prefilter and create or edit a prefilter policy.

Step 2

Click Add Prefilter Rule.

You can also right-click a rule and select Insert New Prefilter Rule.

Step 3

Enter a name for the rule.

Step 4

Configure these rule attributes:

  1. Check the Enabled check box to enable the rule. A rule must be enabled to affect traffic through the device.

  2. Choose the action to be taken on matching traffic from the Action drop-down list.

    You have these actions to choose from:

    • Fastpath—Exempts matching traffic from all further inspection and control, including access control, identity requirements, and rate limiting. These connections are eligible for flow offload if the device supports it.

    • Block—Blocks matching traffic without further inspection of any kind.

    • Analyze—Allows traffic to continue to be analyzed by the rest of access control. If passed by access control and any related deep inspection, this traffic may also be rate limited.

  3. Specify where to insert the rule in the policy.

    The default is to insert the rule at the end of the policy, but you can select an existing rule and insert the new rule before or after that rule. The action of the first rule that matches a connection is applied to that connection, so order matters.

  4. (Optional.) Select the object that defines the Time Range for the rule.

    You can limit what times of day, or which days, a rule is operational. For example, the rule could apply during business hours only. Select an existing time range object or create a new one. For more information, see Create a time range object.

  5. Configure the traffic matching conditions for the rule.

    Within a condition type, if any selected item matches, the connection matches that condition type. For the entire rule, a connection must match at least one item in each condition type to meet the rule.

    • Interface Objects—Select the security zones or interface groups that contain the interfaces to which the rule should apply. The default, no objects selected, applies the rule to all interfaces on the device.

    • Networks—Select the network objects that define the source (Add to Source) or destination (Add to Destination) IP addresses, or both. The default (no objects selected) matches all source and destination IP addresses.

    • VLAN Tags—Select the objects that define the VLANs to which the rule should apply. For more information, see VLAN tags rule conditions.

    • Ports—Select the TCP/UDP ports, or other protocol, for the connections and add them to the source or destination criteria. Source criteria is TCP/UDP only, but you can select other protocols for the destination. For more information, see Port rule conditions for prefilter rules.

  6. (Fastpath and Block rules only.) Click Logging and configure how matching connections should be logged.

  7. Click Comment and add comments to the rule. Use comments to help you understand the purpose of the rule and its change history. This is optional.

Step 5

Click Add.

Step 6

Click Save to save the policy.