[USG Flex H] - Block rule to broadcast IP

Maverick87 · July 10

Hello everyone,
I've an IoT device (on 192.168.0.0/24 LAN) that needs to communicate with the broadcast IP (192.168.0.255) on port 59387, but seems that the rule are blocked.

Why? What I'm wrong?
What is the rule that I need to add to unblock it?

Thank you

Zyxel_Judy · July 15

Hi @Maverick87 ,

We need to have these kinds of logs appear because it shows the traffic hits the Policy Control rule "Deny Any to Any" (the last/default policy), which applies to traffic in both the LAN and WAN directions.

In case you don't want to have the block logs from LAN to broadcast IP, you can add a policy (LAN → Broadcast) with logging disabled before the last implicit default deny policy to achieve the desired filtering. The steps as below:

Navigate to Security Policy > Policy Control in the Web GUI.
Create a new policy rule positioned near the bottom of your rule list (directly above the implicit default-deny rule).
Set the parameters as follows:

Source: Any (or the specific local zones/subnets, e.g., LAN)
Destination: Create and select an address object for the broadcast address
Action: Deny/ Reject
Log: No Log

4. Save the rule.

PeterUK · July 10

A broadcast for like UDP to the USG will Always (from what I can tell) be blocked so you have like
LAN IP/subnet 192.168.0.0/24
a switch to USG with devices at 192.168.0.31 and 192.168.0.100
when a broadcast happens from like 192.168.0.31 the switch on the same VLAN broadcast to all ports which 192.168.0.100 will see but also the USG at like 192.168.0.1

I guess really the USG could filter these broadcast out to not show in the logs

Maverick87 · July 10

Hi @PeterUK,

Thank you, so is not an "error", the communication is not really blocked and I can ignore it?

Thank you

PeterUK · July 10

yes you can ignore it

Maverick87 · July 12

Hi @PeterUK,
I've opened an Idea to hide/remove this entry log (writes uselessly inside the log, taking up space for other more interesting logs).

https://community.zyxel.com/en/discussion/33561/usg-flex-h-remove-hide-policy-rule-log-to-broadcast-address

Zyxel_Judy · July 15

Hi @Maverick87 ,

We need to have these kinds of logs appear because it shows the traffic hits the Policy Control rule "Deny Any to Any" (the last/default policy), which applies to traffic in both the LAN and WAN directions.

In case you don't want to have the block logs from LAN to broadcast IP, you can add a policy (LAN → Broadcast) with logging disabled before the last implicit default deny policy to achieve the desired filtering. The steps as below:

Navigate to Security Policy > Policy Control in the Web GUI.
Create a new policy rule positioned near the bottom of your rule list (directly above the implicit default-deny rule).
Set the parameters as follows:

Source: Any (or the specific local zones/subnets, e.g., LAN)
Destination: Create and select an address object for the broadcast address
Action: Deny/ Reject
Log: No Log

4. Save the rule.

Maverick87 · July 15

Hi @Zyxel_Judy,
Thank you

I've created the rule and all works.
One point: the rule needs to be created with To: ZyWall zone

Thank you

[USG Flex H] - Block rule to broadcast IP

Accepted Solution

All Replies

Categories

Security Help Center