Configuring tunnel rules

Use tunnel rules in a non-default prefilter policy to

Provide early blocking for unwanted encapsulated tunnel traffic.
Fast path tunnels that do not benefit from access control inspection.
Place encapsulated tunnels into a tunnel zone, called rezoning, so that you can write access control rules to apply inspection to the connections within the tunnel as a whole.

Before you begin

The prefilter policy’s default action applies to encapsulated tunnels. Thus, create rules for tunnel traffic only to apply different actions to specific tunnels.

For example, if the default action is to analyze tunnels, this means that all tunnels are passed on to the access control policies and other policies that inspect, allow, and potentially block connections, and these policies will evaluate the inner connections. If that default action is what you want for all tunnels, then you do not need to create any tunnel rules.

If instead:

The default action is to block encapsulated tunnels, use rules to exempt specific tunnels from blocking and either pass them to other access control policies (analyze action) or bypass any additional processing (fastpath).
There are tunnels where you want to apply access control rules to all encapsulated connections, create rules to rezone the tunnels to the appropriate tunnel zone tag and also write rules in the access control policy for those tunnel zone tags.

Procedure

Step 1

Choose Policies > Security policies > Prefilter and create or edit a prefilter policy.

Step 2

Click Add Tunnel Rule.

You can also right-click a rule and select Insert New Tunnel Rule.

Step 3

Enter a Name for the rule.

Step 4

Select whether the rule should be Enabled. A rule must be enabled to affect traffic through the device.

Step 5

Select the Action to be taken on matching traffic.

Fastpath—Exempts matching traffic from all further inspection and control, including access control, identity requirements, and rate limiting. Fastpathing a tunnel fastpaths all encapsulated connections. These connections are eligible for flow offload if the device supports it.
Block—Blocks matching traffic without further inspection of any kind. Blocking a tunnel blocks all encapsulated connections.
Analyze—Allows traffic to continue to be analyzed by the rest of access control using inner headers.. If passed by access control and any related deep inspection, this traffic may also be rate limited.

Step 6

Select where to Insert the rule.

The default is to insert the rule at the end of the policy, but you can select an existing rule and insert the new rule before or after that rule. The action of the first rule that matches a connection is applied to that connection, so order matters.

Step 7

(Analyze rules only; when rezoning only.) Select a tunnel zone tag in Assign Tunnel Zone if your intention is to rezone the tunnel.

Leave this option blank if you want access control to apply to the encapsulated connections within the tunnel without special processing. For more information about rezoning and tunnel group tags, see:

Caution

Exercise caution when assigning tunnel zones. Connections in rezoned tunnels may not match security zone constraints in later evaluation. See How to rezone tunnels for customized inspection for a brief walkthrough of a tunnel zone implementation, and a discussion of the implications of rezoning without explicitly handling rezoned traffic.

Step 8

(Optional.) Select the object that defines the Time Range for the rule.

You can limit what times of day, or which days, a rule is operational. For example, the rule could apply during business hours only. Select an existing time range object or create a new one. For more information, see Creating Time Range Objects.

Step 9

Select one of the following options to set the direction for the rule:

Match tunnels only from source (unidirectional)—Match source-to-destination traffic only. Matching traffic must originate from one of the specified source interfaces or tunnel endpoints, and leave through one of the destination interfaces or tunnel endpoints. Return traffic for allowed connections is also permitted. (Note that prefilter rules are always unidirectional.)
Match tunnels from source and destination (bidirectional)—Match both source-to-destination traffic and destination-to-source traffic. The effect is identical to writing two unidirectional rules, one the mirror of the other. This is the default.

Step 10

Click the Encapsulation & Ports tab and select the protocols for this rule.

You must select at least one of these options in a tunnel rule to specify the encapsulation protocol used. The list includes the IP protocol number for the option.

GRE (47)
IP-in-IP (4)
IPv6-in-IP (41)
Teredo (UDP (17)/3455)

Step 11

Configure the traffic matching conditions for the rule.

The rule is applied to connections that match all of the conditions. Within a condition type, separate elements are OR’ed, so that matching any of the selected items counts as a match. For the rule as a whole, all condition types are AND’ed: a connection must match at least one item on each tab to match the rule. You can use the following types of conditions:

Interface Objects—Select the security zones or interface groups that contain the interfaces to which the rule should apply. The default, no objects selected, applies the rule to all interfaces on the device.
Tunnel Endpoints—The network objects that define the source (Add to Source) and destination (Add to Destination) IP addresses of the tunnel. The default (no objects selected) matches all source and destination IP addresses.
VLAN tags—Select the objects that define the VLANs to which the rule should apply. For more information, see VLAN tags rule conditions.

Step 12

(Fastpath and Block rules only.) Click Logging and configure how matching connections should be logged.

Step 13

(Optional.) Click Comment and add comments to the rule. Use comments to help you understand the purpose of the rule and its change history.

Step 14

Click Add. If you need to move the rule, do so now.

Step 15

Click Save to save the policy.