Configuring a User-defined Policy

Procedure

1. Access the interworking policy view from the system view.

   rightm-policy

2. Create an interworking policy and access its view.

   rule name rule-name

3. Optional: Configure description for the interworking policy.

   description description-information

4. Optional: Configure a tag for the policy.

   add tag tag-name

   After policies reference tags, you can query policies based on tags and delete, move, enable, or disable policies in batches based on query results. For the tag description and configuration, see Tag.

5. Configure match conditions of the interworking policy.

   • If multiple interworking policies are configured, they are matched based on their priorities. By default, policies configured earlier have higher priorities. You can use the rule move command to manually change the policy priorities. If the traffic matches an interworking policy, the remaining interworking policies are ignored. Therefore, you must place the policies from the most specific to the least specific.

   • The system has an implicit deny all policy. Interzone traffic that does not match any interworking policy is discarded. The default policy denies interzone traffic, including but not limited to the traffic sent and received by the FW and the traffic between security zones. Intrazone traffic is allowed by default. To control the forwarding of intrazone traffic, configure specific policies.
   • Each policy contains one or more match conditions, such as source and destination IP addresses and services. All conditions in a policy take effect on packets. This means that a packet must meet all conditions to match the policy. The default conditions of a policy are all any, which means that all traffic (including intrazone traffic) matches the policy.
   • A match condition may specify multiple traffic attributes. A packet that matches any of the traffic attributes in the match condition is considered to have matched the condition.

   Task	Command
   Specify a source IP address.	source-address { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard } [ description description ] | range { ipv4-start-address ipv4-end-address } [ description description ] | any } source-address-exclude { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard | range { ipv4-start-address ipv4-end-address } } [ description description ]
   Specify a destination IP address.	destination-address { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard } [ description description ] | range { ipv4-start-address ipv4-end-address } [ description description ] | any } destination-address-exclude { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard | range { ipv4-start-address ipv4-end-address } } [ description description ]
   Configure a service (reference a service or service group).	service { service-name &<1-6> | any } service-exclude service-name &<1-6>
   Specify the validity period.	time-range time-range-name

   You can create different policies in one policy view for different types of traffic. By default, the earliest configured policy has the highest priority and is preferentially matched. You can use commands to change the policy priorities. For details, see Follow-up Procedure.

6. Set an action for the interworking policy.

   action { permit | deny }

   The specified action is taken for the traffic matching the interworking policy. permit: permits the traffic that matches the rule. deny: implements authentication for users whose the traffic matches the rule.

7. Return to the system view.

   quit

8. Optional: Access the interzone policy view and apply the interworking policy.

   You do not need to run the following command if a interworking policy has been applied in Configuring the Connection Between the SACG and Service Controller. If no interworking policy has been applied, run the following command:

   firewall interzone [ vpn-instance vpn-instance-name ] zone-name1 zone-name2

   apply packet-filter right-manager { inbound | outbound }

   

   User-defined policies take effect immediately after being created. Therefore, you do not need to apply interworking policies for them.