Content Filter profiles and security policies priority

Options
SistemistaDaRidere
SistemistaDaRidere Posts: 21 image  Freshman Member
First Comment Friend Collector Fifth Anniversary
edited July 11 in Security

Good morning

i need to apply a stricter content filter profile to the whole LAN, while some hosts need a more permissive one.

I thought i just needed to apply the stricter profile to the "LAN_Outgoing" default rule and to write an upper priority rule with the more permissive profile for my trusted hosts group.

Seems to me that both profiles are applied as the rules list goes to its end, with this kind of behaviour:

  1. Upper priority rule / permissive profile ⇒ trusted host ip matches ⇒ permissive profile should be applied, but it keep going to…
  2. LAN_Outgoing / strict profile ⇒ trusted host ip matches again as it is part of the entire network ⇒ stricter profile is applied

As the free hosts IPs are not progressive, I can't write a bunch of rules with different profiles to segment the entire LAN six or more times.

I also tried to simply exclude the hosts using "IP Exceptions" but it seems to only work for "reputation filter" and not for "content filter"

Any suggestions will be appreciated.

All Replies

  • PeterUK
    PeterUK Posts: 4,608 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited July 11
    Options

    Not one for using Content Filter but let see if I can work something out

    so you have
    permissive profile
    strict profile

    and you want to restrict like 192.168.0.2 with strict profile and by 192.168.0.100 with permissive profile

    you have Policy Control in order
    from zone LAN
    to zone WAN
    source IP 192.168.0.2
    strict profile

    from zone LAN
    to zone WAN
    source IP 192.168.0.100
    permissive profile

    which I would think should work?

  • Zyxel_Tina
    Zyxel_Tina Posts: 933 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    Hi @SistemistaDaRidere,

    To help us better understand and reproduce the behavior you're seeing, could you please provide the following information?

    1. Which Zyxel product model and firmware version are you currently using?
    2. Could you share screenshots of your Security Policy configuration via private message? (Feel free to include any other relevant settings, such as your content filter.)

    This information will help us investigate the issue more accurately.

    Zyxel Tina

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 21 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/85817#Comment_85817

    Actually i would like to have 192.168.1.0/24 - strict

    Of wich, let's say, 192.168.1.10, 192.168.1.25, 192.168.1.50 - permissive

  • Maverick87
    Maverick87 Posts: 211 image  Master Member
    5 Answers First Comment Friend Collector
    edited July 28
    Options

    Hi @SistemistaDaRidere,

    You need to split the policy between permissive and strict, in which the difference is the source.

    So… primarily you need:

    • Define a series of address object via IP: 192.168.1.10, 192.168.1.25 and 192.168.1.50 (obviusly if you would like to maintain the same IP you need to define a static DHCP rule)
    • Then, you need to create an address object group in which you add the address objects created before.

    Then:

    • You need to create a first policy rule for permissive, set the source as the address object group created and using the permissive profile
    • Under this rule, use the LAN_Outgoing (or whatelse) using the strict profile; you can leave "any" as source (since this rule is below the other one, it has less precedence on the permissive hosts)

    In this manner, when you use an "permissive host" the hinting rule is the rule that have the source ip defined into the object group, if the host is not defined into the group, it's hint the secondary rule.

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 21 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/86072#Comment_86072

    Thank you Maverick ('87 here too)

    That's what i've done but content filter seems to bypass the upper/lower logic.

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 21 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/85853#Comment_85853

    Thank you Tina, i will provide the informations you requested in short time, i promise.

  • Maverick87
    Maverick87 Posts: 211 image  Master Member
    5 Answers First Comment Friend Collector
    edited July 29
    Options

    @SistemistaDaRidere also I'm Italian too 😂😂

    Have you tried to unconfigure the content filter rule for both the policy rule and see if an permissive host hint the correct policy?

    So same policy rule without content filter, the only difference is the source ip. I'm expecting that when you use the permissive host, the hint pass via the policy with the source object group; instead if you use a restricted host the hinting rule is the "LAN_Outgoing".

    In this way, without content filter applied, we can exclude there is a problem with the policy rule.

    You can share some screenshot about the configuration of the policies?

    Thank you

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 21 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    Options

    Ciao Maverick,

    haven't had time yet to take this try, but i noticed that the issue stops if i disable DNS Safesearch on the profile that is being applied to other rules (strict)

    image.png

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）