Security Policies

Overview

security policy is one of the basic security functions of the device. It can permit or deny packets based on certain conditions. Packet filtering conditions include source/destination IP addresses, source/destination ports, services, time ranges, users, and applications. You can rapidly filter packets based on users and applications. The device integrates packet filtering and content security into security policy configuration. You can perform unified configuration and management based on the configured policies, simplifying administrative operations and improving network security. You can configure security policies to enable the device to identify traffic with attack features and permit or deny the traffic as required. You can also configure IPS, antivirus, file blocking, and mail filtering to defend against viruses, worms, Trojan horses, and illegitimate files.

If general security policies are used, unauthorized users can freely access the network and launch attacks. As such, you are advised to carefully analyze a network's traffic model and configure refined security policies to permit all required traffic and block all unauthorized traffic.

By default, BGP, LDP, BFD, DHCP unicast, DHCPv6 unicast, and OSPF unicast packets are controlled by security policies and default security policies. To enable the device to quickly access the network, run the undo firewall packet-filter basic-protocol enable to stop these packets from being controlled by security policies and default security policies.

For details, see section Configuration Guide > Security Policy.

Impact on the System

By default, traffic that does not match any security policy is blocked.