What is Rule Shadowing in ScreenOS?

What is Rule Shadowing in ScreenOS?

[KB13233] Show KB Properties
[KB13233] Hide KB Properties
Categories: Firewalls ISG/NS/SSG Series ScreenOS	Knowledge Base ID: KB13233 Published: 06 Feb 2009 Version: 1.0

 

Summary:

ScreenOS will match a generic rule before a specific rule, if the generic rule is listed first in the configuration.

 

Problem or Goal:

It is possible in large networks to create rules in the firewall that overlap. In ScreenOS, this is referred to as ‘rule shadowing’.  For example, in the following two polices, the addresses in policy id 4 overlap with the addresses in policy id 3:

set pol id 3 from trust to untrust 192.168.0.1/24 172.16.0.1/24 FTP permit
set pol id 4 from trust to untrust 192.168.0.8/32 172.16.0.8/32 FTP deny

Rule shadowing is used to verify if there are overlapping rules, i.e, a more generic rule before a specific rule. If this is the case, the specific rule will never be used since the generic rule was first in the list. It may be that the shadow rule contains multi-cell objects or groups. However if there are multiple shadow rules, between the same source and destination zones, ScreenOS will only display the first matched shadow rule pair.


 

 

Solution:

The result can be seen in the following CLI output:

nsisg2000-> exec policy verify
Rulebase verified successfully
nsisg2000-> set pol id 3 from trust to untrust 192.168.0.1/24 172.16.0.1/24 FTP permit
nsisg2000-> set pol id 4 from trust to untrust 192.168.0.8/32 172.16.0.8/32 FTP deny
nsisg2000-> exec policy verify
Rule 4 is shadowed by rule 3
Rulebase verification done: shadowed rules were found
nsisg2000->

In this example, policy id 4 will never be executed.
It is recommended you run the 'exec policy verify' command after performing policy changes in order to confirm that a policy is not being shadowed.

Note:  The “exec policy verify” is part of the Deep Inspection (DI) feature, and cannot be used if there are IDP Security Modules and an IDP license installed on the ISG-series firewall. Since DI and IDP cannot be used together, the command is unavailable.
 

 

 

 

 

Related Links: