usg firewall security policy configuration

usg firewall security policy configuration

1. security-policy
2. rule name 禁止访问生产pulsar
3. description 办公网络禁止访问生产pulsar
4. source-zone trust
5. destination-zone untrust
6. source-address address-set 192.168.10.0
7. destination-address domain-set 生产pulsar组
8. action deny
9. policy logging
10. traffic logging enable

The above is a security policy configuration, including the following parts:

1. security-policy: Indicates that the rule applies to all rules in the security policy.

2. rule name 禁止访问生产pulsar: Indicates that the name of this rule is "Prohibit access to production pulsar".

3. description 办公网络禁止访问生产pulsar: Indicates a brief description of the rule, indicating that the function of the rule is to restrict the office network from accessing the Pulsar system in the production environment.

4. source-zone trust: Indicates that the data flow matched by this rule comes from the security zone named "trust".

5. destination-zone untrust: Indicates that the data flow matched by this rule will flow to the security zone named "untrust".

6. source-address address-set 192.168.10.0: Indicates that the source address is the IP address set "192.168.10.0", that is, the host or subnet whose source address is limited to 192.168.10.0/24.

7. destination-address domain-set 生产pulsar组: Indicates that the target address is a set of domain names "production pulsar group", that is, a group of domain names used in the production Pulsar system to restrict access.

8. action deny: Indicates that traffic matching this rule should be blocked from transmission.

9. policy logging: Indicates that the logging function is enabled.

10. traffic logging enable: Indicates that the traffic recording function is enabled to trace and analyze blocked data flows.

In general, this rule can restrict access to specific source and destination addresses, prevent unauthorized users or hosts from accessing the Pulsar system in the production environment, and ensure system security and stability. It should be noted that this rule is only a part of the security policy and should be comprehensively considered and managed in conjunction with other rules and security measures.