Filter
Top Products
ProSecure Unified Threat Management UTM10 or UTM25 Reference Manual
8-32 Virtual Private Networking Using SSL Connections
v1.0, September 2009
For example, a policy that is configured for a single IP address takes precedence over a policy that
is configured for a range of addresses. And a policy that applies to a range of IP addresses takes
precedence over a policy that is applied to all IP addresses. If two or more IP address ranges are
configured, then the smallest address range takes precedence. Host names are treated the same as
individual IP addresses.
Network resources are prioritized just like other address ranges. However, the prioritization is
based on the individual address or address range, not the entire network resource.
For example, assume the following global policy configuration:
• Policy 1: A Deny rule has been configured to block all services to the IP address range
10.0.0.0 – 10.0.0.255.
• Policy 2: A Deny rule has been configured to block FTP access to 10.0.1.2 – 10.0.1.10.
• Policy 3: A Permit rule has been configured to allow FTP access to the predefined network
resource with the name FTP Servers. The FTP Servers network resource includes the
following addresses: 10.0.0.5 – 10.0.0.20 and the FQDN ftp.company.com, which resolves to
10.0.1.3.
Assuming that no conflicting user or group policies have been configured, if a user would attempt
to access:
• an FTP server at 10.0.0.1, the user would be blocked by Policy 1.
• an FTP server at 10.0.1.5, the user would be blocked by Policy 2.
• an FTP server at 10.0.0.10, the user would be granted access by Policy 3. The IP address range
10.0.0.5 - 10.0.0.20 is more specific than the IP address range that is defined in Policy 1.
• an FTP server at ftp.company.com, the user would be granted access by Policy 3. A single host
name is more specific than the IP address range that is configured in Policy 2.
Viewing Policies
To view the existing policies, follow these steps:
1. Select VPN > SSL VPN from the menu. The SSL VPN s submenu tabs appear, with the
Policies screen in view. (Figure 8-18 on page 8-33 shows some examples.)
Note: The user would not be able to access ftp.company.com using its IP address
10.0.1.3. The UTM’s policy engine does not perform reverse DNS lookups.