Organization-wide Group Policy Troubleshooting

How do they work?

An Enforcement Target defines the "who" or "what" the policy applies to. Please note that rules are enforced by the MX, meaning the MX must be routing the traffic for the policy to take effect. Two common questions that come up are: 

• What happens when VLAN(s) are selected?
• What happens when an SGT is selected?

Example: I configure a policy with enforcement target VLAN 10 for two of my networks. The following networks have VLAN 10 configured like this:

• Location 1:   10.10.1.0/24
• Location 2:  10.10.2.0/24

When I attach a ruleset, the rules that have an "Any" as the source, the Dashboard will automatically fill in the subnets. So if I have a rule like this: 

• Action: Allow
• Source: Any
• Destination: 208.67.222.222 

For Location 1, the MX will enforce the following: 

• Action: Allow
• Source:  10.10.1.0/24
• Destination: 208.67.222.222 

For Location 2, the MX will enforce the following: 

• Action: Allow
• Source:  10.10.2.0/24
• Destination: 208.67.222.222 

If we added the enforcement target VLAN 11 - Location 1 (10.11.1.0/24),  the MX will enforce the following: 

• Action: Allow
• Source:  10.10.1.0/24 OR 10.11.1.0/24
• Destination: 208.67.222.222 

If you attempt to select an Enforcement Target that is already attached to a different policy, a warning will appear.

Example: In the image below, we are adding an Enforcement Target to a policy named Workstation. When attempting to select Retail Store 3 - VLAN 2, an alert appears because this VLAN is already associated with the Guest Internet Access policy. Proceeding by clicking Save will remove the VLAN from the previous policy ("Guest Internet Access") and reassign it to the new Workstation policy.

Empty Rulesets

If a ruleset is empty when it is attached to a Policy, the ruleset will emit an allow any source to any destination rule. Please visit the User Guide for more information on configuring Rulesets

Understanding Layer 7 Rules in your Ruleset

When creating firewall rules with Organization-wide Group Policy, you are able to create rules with both IP and Layer 7 Applications. When you add Layer 7 rules, it is expected that a small number of packets may pass through the firewall before being classified. This occurs because NBAR (Network-Based Application Recognition) requires several initial packets to accurately identify the application traffic. For classification purposes, up to 7 packets or a total of 2000 bytes may be allowed before enforcement begins. Please see the example below for details.

• Rule 1
  • Action: Deny
  • Source: Any
  • Destination: 1.1.1.1/32
• Rule 2
  • Action: Deny
  • Source: Any
  • Destination: 2.2.2.2/32
• Rule 3
  • Action: Deny
  • Source: Any
  • Destination: Application X 
• Rule 4
  • Action: Deny
  • Source: Any
  • Destination:  4.4.4.4/32

What to expect: 

• Rule 1: All packets to this destination are dropped immediately when the MX first sees the packet (application classification is not required).
• Rule 2: All packets to this destination are dropped immediately when the MX first sees the packet (application classification is not required).
• Rule 3: The MX may allow up to 7 packets or a total of 2000 bytes for classification before the rule is enforced. This is necessary for proper application identification.
• Rule 4: The MX may allow up to 7 packets or a total of 2000 bytes for classification before the rule is enforced.
• Rule X: Any additional rules will behave similarly, allowing a small number of packets or bytes for initial classification.

The temporary allowance of a small number of packets for application classification is expected behavior and is required for accurate traffic identification. Once the application is recognized, the configured Layer 7 rule is fully enforced, and no additional packets will be allowed. 

Adaptive Policy