close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Introduction
play_arrow Managing Sites, Site Groups, and Site Templates
play_arrow Managing Devices and Resources
play_arrow Managing Policies, Profiles, and Proxies
play_arrow Managing Network Services and Shared Objects
- play_arrow Configuring Network Services
- play_arrow Managing Shared Objects
play_arrow Monitoring Jobs and Audit Logs
- play_arrow Managing Jobs
- play_arrow Managing Audit Logs
play_arrow Monitoring Alarms, Events, and Threats
- play_arrow Monitoring Security Alerts and Alarms
- play_arrow Monitoring Security
- play_arrow Monitoring SD-WAN Events
  - SD-WAN Events Overview
  - About the SD-WAN Events Page
- play_arrow Monitoring Applications
- play_arrow Monitoring Threats
  - About the Threats Map (Live) Page
- Syslog Streaming
play_arrow Managing Reports
- play_arrow Security Reports
- play_arrow SD-WAN Reports

list Table of Contents

English

Example 1: Firewall Policy that Permits Traffic from Departments in Site A to the Departments in Site B
Example 2: Firewall Policy that Permits Internet Access for all Departments in Site A and Site B
Example 3: Firewall Policy that Permits Any Public Internet Address to Access the Sales Department in Site B
Example 4: Firewall Policy that Permits Social Media Access to all Departments in Site A
Example 5: Firewall Policy that Controls Access to Specific Applications for Various Departments
Example 6: Firewall Policy that Denies Access to Social Networking Sites
Example 7: Firewall Policy that Controls Access to an Address over the Internet (HTTP)
Example 8: Firewall Policy that Permits or Denies the Use of HTTP or FTP as a Service
Example 9: Firewall Policy that Denies Access to BitTorrent to the Finance Departments across both Site A and Site B
Example 10: Firewall Policy that Allows Access to Facebook for Users in User Group A
Example 11: Firewall Policy that Permits User B in Site A Access to YouTube with Content Security Enabled
Example 12: Firewall Policy that blocks access to Internet and allow access to Google Drive.

keyboard_arrow_right

Firewall Policy Examples

Release: Contrail Service Orchestration 6.3.0

date_range 27-May-23

arrow_backward

arrow_forward

This topic provides information on how firewall policy intents that you define as part of your firewall policy is handled by Contrail Service Orchestration (CSO), using various examples. Each of the examples provide detailed explanation about how a firewall policy intent defined through the CSO GUI resolves into configuration in the system.

Note:

For more information, see Firewall Policy Overview and Adding Firewall Policy Intents.

For easier understanding, all the examples have been defined to use the topology in illustrated in Figure 1. In this topology, there are two sites—site A and site B. Each site has two departments defined as follows:

Site A - IT (LAN segment LS1) and Finance (LAN segment LS2).
Site B - Finance (LAN segment LS3) and Sales (LAN segment LS4).

Figure 1: Topology Diagram

The following definitions are applicable to all the examples:

While creating a site, you can designate some of the WAN interfaces to be breakout interfaces. These WAN interfaces can carry both site-to-site traffic (through the trust zone) and breakout traffic (through the untrust zone). The WAN interfaces can also be designated exclusively for carrying breakout traffic.
A trust zone refers to the overlay interface that contains all the GRE tunnel interfaces, such as gr-0/0/0.1, gr-0/0/0.2, and IPSec interfaces, such as st0.1, st0.2 created between the sites.
An untrust zone refers to the underlay interfaces (underlying physical interfaces) such as ge-0/0/0, ge-0/0/1.
If you select an address or a service as a destination endpoint, CSO considers it as an address or service hosted on the Internet, unless the selected address or service is associated with a site.

Table 1 captures the addresses associated with the LAN segments used in the topology illustrated in Figure 1.

Table 1: LAN Segments Definition
Site	Department	LAN Segment	LAN Segment Address
site A	IT	LS1	192.0.2.0/24
site A	Finance	LS2	192.168.1.0/24
site B	Finance	LS3	198.51.100.0/24
site B	Sales	LS4	203.0.113.0/24

The following examples help you understand the creation of intent-based firewall policies for various traffic scenarios across sources and destinations.

Example 1: Firewall Policy that Permits Traffic from Departments in Site A to the Departments in Site B

Define a firewall policy that permits traffic from the departments in site A to the departments in site B.

Table 2 shows the firewall policy intent that is defined:

Table 2: Firewall Policy Intent Definition for Example - 1
Source	Destination	Action
site A	site B	Permit

Table 3 shows how this firewall policy intent is resolved:

Table 3: Firewall Policy Intent Resolution for Example - 1
Site	Source Department	Source Address	Zone	Destination Address	Service	Intent Created
site A	Finance	[LS2]	Trust	[LS3, LS4]	Any	Intent 1__0
site A	IT	[LS1]	Trust	[LS3, LS4]	Any	Intent 1__1
site B	Trust	[LS3, LS4]	Sales	[LS2]	Any	Intent 1__0
site B	Trust	[LS3, LS4]	Finance	[LS1]	Any	Intent 1__1

Configuration Output Sample

Sample of configuration that permits traffic from departments in site A to the departments in site B.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone FINANCE to-zone trust {
       policy Intent_1__0 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address [ls-198.51.100.0/24-SP50-L3,
				 ls-203.0.113.0/24-SP50-L4];
            application any;
	     }
	then { 
	    permit; 
	     }
         } 
     }
from-zone IT to-zone trust {
       policy Intent_1__1 {
        match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address [ls-198.51.100.0/24-SP50-L3,
                         ls-203.0.113.0/24-SP50-L4];
            application any;
             }
        then { 
  	    permit; 
	     } 
         } 
    }		

Sample of configuration that permits traffic from departments in site B to the departments in site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone trust to-zone SALES {
       policy Intent_1__0 {
           match {
               source-address [ls-198.51.100.0/24-SP50-L3,
  			       ls-203.0.113.0/24-SP50-L4];
	       destination-address ls-192.0.2.0/24-S42-L1;
               application any;
                }
           then {
               permit;
		} 
           } 
      }
from-zone trust to-zone FINANCE {
     	policy Intent_1__1 {
          match {
              source-address [ls-198.51.100.0/24-SP50-L3,
			      ls-203.0.113.0/24-SP50-L4];
              destination-address ls-192.168.1.0/24-SP50-L2;
              application any;
              }
          then {
              permit;
               } 
	  } 
     }

Example 2: Firewall Policy that Permits Internet Access for all Departments in Site A and Site B

Define a firewall policy that permits all the department in site A and site B access to Internet.

Table 4 shows the firewall policy intent that is defined:

Table 4: Firewall Policy Intent Definition for Example - 2
Source	Destination	Action
site A	http, https, icmp-ping, dns	Permit
site B	http, https, icmp-ping, dns	Permit

Table 5 shows how this firewall policy intent is resolved:

Table 5: Firewall Policy Intent Resolution for Example - 2
Site	Source Department	Source Address	Zone	Destination Address	Service	Intent Created
site A	Finance	[LS2]	Untrust	Any	http, https, icmp-ping, dns	Intent 1__0
site A	IT	[LSI]	Untrust	Any	http, https, icmp-ping, dns	Intent 1__1
site B	Sales	[LS4]	Untrust	Any	http, https, icmp-ping, dns	Intent 1__0
site B	Finance	[LS3]	Untrust	Any	http, https, icmp-ping, dns	Intent 1__1

Configuration Output Sample

Sample of configuration that permits Internet access to all departments in site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
     policy Intent_1__0 {
        match {
               source-address ls-192.168.1.0/24-SP50-L2;
               destination-address any;
               application [junos-http junos-dns-tcp junos-https 
                             junos-icmp-ping];
               }
         then {
                permit;
               }
           }
      }
from-zone IT to-zone untrust {
     policy Intent_1__1 {
        match {
               source-address ls-192.0.2.0/24-S42-L1;
               destination-address any;
               application [junos-http junos-dns-tcp junos-https
                             junos-icmp-ping];
               }
        then {
               permit;
             }
         }
     }
	policy-rematch;

Sample of configuration that permits Internet access to all departments in site B.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Sales to-zone untrust {
     policy Intent_1__0 {
        match {
               source-address ls-203.0.113.0/24-SP50-L4;
               destination-address any;
               application [junos-http junos-dns-tcp junos-https 
                             junos-icmp-ping];
              }
        then {
              permit;
             }
         }
     }
	from-zone Finance1 to-zone untrust {
      policy Intent_1__1 {
         match {
                source-address ls-198.51.100.0/24-SP50-L3;
                destination-address any;
                application [junos-http junos-dns-tcp junos-https 
                              junos-icmp-ping];
                }
          then {
                permit;
               }
           }
      }
	 policy-rematch;

Example 3: Firewall Policy that Permits Any Public Internet Address to Access the Sales Department in Site B

Define a firewall policy that permits any public Internet address access to a sales application hosted by the Sales department in site B.

Note:

For this example, breakout is not enabled and MPLS link type is used.

Table 6 shows the firewall policy intent that is defined:

Table 6: Firewall Policy Intent Definition for Example - 3
Source	Destination	Action
Internet	Sales, site B	Permit

Table 7 shows how this firewall policy intent is resolved:

Table 7: Firewall Policy Intent Resolution for Example - 3
Source Address	Zone	Destination Address	Service	Intent Created
Any public Internet address	Trust to Sales (No breakout)	[LS4]	Any	Intent 1__0

Configuration Output Example

Sample of configuration that permits any public Internet address to access the Sales department in site B.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone untrust to-zone Sales {
     policy Intent_1__0 {
        match {
               source-address any;
               destination-address ls-203.0.113.0/24-SP50-L4;
               application any;
               }
        then {
               permit;
             }
         }
     }

Example 4: Firewall Policy that Permits Social Media Access to all Departments in Site A

Define a firewall policy that permits all departments in site A access to Facebook.

Table 8 shows the firewall policy intent that is defined:

Table 8: Firewall Policy Intent Definition for Example - 4
Source	Destination	Action
site A	Facebook	Permit

Table 9 shows how this firewall policy intent is resolved:

Table 9: Firewall Policy Intent Resolution for Example - 4
Site	Source Address	Zone	Destination Address	Service	Intent Created	Application Firewall Profile
site A	[LS2]	Untrust	Facebook	Any	Intent 1__0	AppFwProfile_0
site A	[LS1]	Untrust	Facebook	Any	Intent 1__1	AppFwProfile_0

Configuration Output Example

Sample of configuration that controls access to Facebook for site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
     policy Intent_1__0 {
        match {
               source-address ls-192.168.1.0/24-SP50-L2;
               destination-address any;
               application any;
               }
         then {
               permit {
                  application-services {
                  application-firewall {
                  rule-set AppFwProfile_0;
                  }
                }
              }
            }
          }
        }
	from-zone IT to-zone untrust {
      policy Intent_1__1 {
         match {
                source-address ls-192.0.2.0/24-S42-L1;
                destination-address any;
                application any;
                }
          then {
                permit {
                   application-services {
                   application-firewall {
                   rule-set AppFwProfile_0;
                   }
                 }
               }
             }
           }
         }
		policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
application-firewall {              
   rule-sets AppFwProfile_0 {
       rule rule-1 {
               match {
                   dynamic-application junos:FACEBOOK-APP;
                   ssl-encryption any;
                     }
                then {
                    permit;
                }
            }
        default-rule {
          deny;
            }
         }
      }

Example 5: Firewall Policy that Controls Access to Specific Applications for Various Departments

Define a firewall policy that controls access to specific applications from various departments, with the following intents:

The finance departments located in site A and site B (which are in different geographical locations) are permitted to access the news applications BBC and CNN.
The IT department located in site A is denied access to the news applications BBC and CNN.
Access to Telnet and SSH applications is given only to the finance departments.
Access to Telnet and SSH applications is denied to all departments, except for the finance department.

Table 10 shows the firewall policy intents that are to fulfil this requirement:

Table 10: Firewall Policy Intent Definition for Example - 5
Source	Destination	Action
Finance department, site A and Finance department, site B	BBC and CNN	Permit
IT department, site A	BBC and CNN	Deny
Finance department, site A and Finance department, site B	Telnet and SSH	Permit
Any (All addresses except the finance department)	Telnet and SSH	Deny

Note:

The number of intents depends on the number of source sites within the given department and the number of destination sites.

Table 11 shows how this firewall policy intent is resolved:

Table 11: Firewall Policy Intent Resolution for Example - 5
Source Department	Source Address	Zone	Destination Address	Service	Application Firewall Profile
Finance	[LS2]	Trust/Untrust	Any	Any	AppFwProfile_1 Permit: CNN/BBC Def. Rule : Permit
Finance	[LS3]	Trust/Untrust	Any	Any	AppFwProfile_1 Permit: CNN/BBC Def. Rule : Permit
IT	[LS1]	Trust/Untrust	Any	Any	AppFwProfile_3 Deny: CNN/BBC Def. Rule : Deny
Finance department, site A and Finance department, site B	[LS2, LS3]	Trust/Untrust	Any	Telnet, SSH	AppFwProfile_1-1 Permit: Telnet/SSH Def. Rule : Deny
IT department, site A	[LS1]	Trust/Untrust	Any	Telnet, SSH	AppFwProfile_3-1 Deny: Telnet/SSH Def. Rule : Deny

Configuration Output Example

Sample of configuration that controls access to specific applications for various departments in site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone trust {
   	  policy Intent_3 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address any;
            application [junos-telnet junos-ssh];
        }
        then {
            permit {
                application-services {  
                    application-firewall {
                        rule-set AppFwProfile_1-1;
                    }
                }
            }
        }
		    }
      policy Intent_1 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address any;
            application any;
        }
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_1;
                    }
                }
            }
        }
		    }
       policy Intent_4__0 {
        match {
            source-address any;
            destination-address any;
            application [junos-telnet junos-ssh];
        }
        then {
            permit;
        		  }
        		}
			  }
from-zone IT to-zone trust {
    	policy Intent_4__1-1 {
        match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address any;
            application [junos-telnet junos-ssh];
       		 }
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_3-1;
                   }
                }
             }
          }
       }
    	policy Intent_2 {
        match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address any;
            application any;
					 }
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_3;
                    }
                 }
              }
           }
         } 
       policy Intent_4__1 {
         match {
            source-address any;
            destination-address any;
            application [junos-telnet junos-ssh];
        	    }
        then {
            deny;
      		    }
    		  }
				}

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_1-1 {
     rule rule-1 {
        match {
            dynamic-application [junos:BBC junos:CNN];
            ssl-encryption any;
             }
        then {
            permit;
             }
	          }
        default-rule {
        deny;
         }
       }
rule-sets AppFwProfile_3 {
     rule rule-2 {
        match {
            dynamic-application [junos:BBC junos:CNN];
            ssl-encryption any;
              }
        then {
            deny;
           }       
         }
        default-rule {
        deny;
         }
       }
rule-sets AppFwProfile_1 {
      rule rule-3 {
        match {
            dynamic-application [junos:BBC junos:CNN];
            ssl-encryption any;
      	       }
        then {
            permit;
            }
          }
        default-rule {
        deny;
         }
        }
rule-sets AppFwProfile_3-1 {
     rule rule-4 {
        match {
            dynamic-application [junos:BBC junos:CNN];
            ssl-encryption any;
             }
        then {
            deny;
             }
            }
      default-rule {
        deny;
          }
       }

Sample of configuration that controls access to specific applications for various departments in site B.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone trust {
     policy appQoe-36600-Permit-rule {
        match {
            source-address any;
            destination-address any;
            application appQoe-36000;
        }
        then {
            permit;
        }
      }
     policy Intent_3 {
        match {
            source-address ls-198.51.100.0/24-SP50-L3;
            destination-address any;
            application [ junos-telnet junos-ssh ];
        }
        then {
            permit {
                application-services {  
                    application-firewall {
                        rule-set AppFwProfile_1-1;
                    }
                 }
              }
           }
        }
      policy Intent_1 {
        match {
            source-address ls-198.51.100.0/24-SP50-L3;
            destination-address any;
            application any;
    	      }
         then {
           permit {
               application-services {
                  application-firewall {
                        rule-set AppFwProfile_1;
                    }
                  }
                }
             }
          }
      policy Intent_4__1 {
         match {
            source-address any;
            destination-address any;
            application [junos-telnet junos-ssh];
          }
         then {
            deny;
    	        }
           }
        }
from-zone Sales to-zone trust {
      policy Intent_4__0 {
        match {
            source-address any;
            destination-address any;
            application [junos-telnet junos-ssh];
             }
        then {
            deny;
        		  }
    		 }
		  }
	 policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_1-1 {
     rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
        match {
            dynamic-application [junos:BBC junos:CNN];
             ssl-encryption any;
            }
        then {
            permit;
             }
          }
         default-rule {
         deny;
           }
         }
rule-sets AppFwProfile_1 {
       rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
         match {
            dynamic-application [junos:BBC junos:CNN];
            ssl-encryption any;
            }
          then {
            permit;
              }
            }
         default-rule {
        deny;
     }
  } 

Example 6: Firewall Policy that Denies Access to Social Networking Sites

Define a firewall policy that denies access to networking sites such as Facebook and Twitter (defined as application group Social Networking) to the IT and finance departments located in Site A.

Table 12 shows the firewall policy intent that is needed to fulfil this requirement:

Table 12: Firewall Policy Intent Definition for Example - 6
Source	Destination	Action
IT and Finance, site A	Application group Social Networking (Facebook and Twitter)	Deny

Note:

Add site A if the IT or finance departments are present in different sites, but you only want to apply this firewall policy intent to the IT or finance departments present in site A.

Table 13 shows how this firewall policy intent is resolved:

Table 13: Firewall Policy Intent Resolution for Example - 6
Source Department	Source Address	Zone	Destination Address	Service	Application Firewall Profile
Finance	[LS2]	Trust/Untrust	Any	Any	AppFwProfile_0 Deny: Social Networking (Apps) Def. Rule : Deny
IT	[LS1]	Trust/Untrust	Any	Any	AppFwProfile_1 Deny: Social Networking (Apps) Def. Rule : Deny

Configuration Output Example

Sample of configuration that denies access to social networking sites for departments in site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone IT to-zone untrust {
        policy Intent_1__0 {
           match {
               source-address  ls-192.0.2.0/24-S42-L1;
               destination-address any;
               application any;
              }
              then {
                 permit {
                     application-services {
                     application-firewall {
                     rule-set AppFwProfile_0;
                        }
                     }
                 }
               }
            }
        }
from-zone Finance to-zone untrust {
         policy Intent_1__1 {
                match {
                    source-address ls-192.168.1.0/24-SP50-L2;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        application-services {
                            application-firewall {
                                rule-set AppFwProfile_0;
                            }
                        }
                    }                   
                }
            }
        }
			

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
application-firewall {
        rule-sets AppFwProfile_0 {
            rule rule-b7e4ed02-e196-400a-88bf-f1de8973d30c-appFwRule {
                match {
                    dynamic-application-group Socialnetwork;
                    ssl-encryption any;
                }
                then {
                    deny;
                }
            }
            default-rule {
                deny;
            }
        }
     }
     

Example 7: Firewall Policy that Controls Access to an Address over the Internet (HTTP)

Define a firewall policy that controls access to an address over the Internet (HTTP) for various sites or site groups with the following intents:

IP address prefix of site A and site B are permitted to access example.com.
IP address prefix of site group Q1 are denied access to example-one.com. Site group Q1 consists of site A and site B.

Table 14 shows the firewall policy intents that are needed to fulfil this requirement:

Table 14: Firewall Policy Intent Definition for Example - 7
Source	Service	Destination	Action
IP address prefix, site A and IP-Prefix, site B	HTTP	www.example.com	Permit
IP address prefix, site group Q1	HTTP	www.example-one.com	Deny

Table 15 shows how this firewall policy intent is resolved:

Table 15: Firewall Policy Intent Resolution for Example - 7
Source Department	Source Address	Zone	Destination Address	Service	Application Firewall Profile
IT, Finance departments in site A	[LS1, LS2]	Trust/Untrust	www.example.com	Any	AppFwProfile_0 Permit: HTTP Def. Rule : Deny
Finance, Sales departments in site B	[LS3, LS4]	Trust/Untrust	www.example.com	Any	AppFwProfile_1 Permit: HTTP Def. Rule : Deny
IT, Finance departments in site A	[LS1, LS2]	Trust/Untrust	www.example-one.com	Any	AppFwProfile_2 Deny: HTTP Def. Rule : Deny
Finance, Sales departments in site B	[LS3, LS4]	Trust/Untrust	www.example-one.com	Any	AppFwProfile_3 Deny: HTTP Def. Rule : Deny

Configuration Output Example

Sample of configuration that controls access to an address over the Internet (HTTP) for site A.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
    	policy Intent_4__0 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address www.example.com;
            application junos-http;
        }
        then {                          
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                 }
              }
           }
       }
      policy Intent_1__0 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address addr2;
            application junos-http;
        }
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_1;
                    }
                 }
              }
           }
        }
     }
from-zone IT to-zone untrust {
    	policy Intent_4__1 {
        match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address addr2;
            application junos-http;
        }
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                 }
              }
           }
        }                                   
		    policy Intent_1__1 {
         match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address addr2;
            application junos-http;
         }
         then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_1;
                    }
                 }
              }
           }
        }
     }
	  policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_1 {
     rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
        match {
            dynamic-application junos:YOUTUBE;
            ssl-encryption any;
        }
        then {
            deny;
          }
        }
        default-rule {
        deny;
        }
       }
rule-sets AppFwProfile_0 {
    rule rule-00f3879c-f3d7-4cb3-89b6-78328e3bff38-appFwRule {
        match {
            dynamic-application junos:CNN;
            ssl-encryption any;
        }
        then {
            permit;
         }
       }
rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
        match {
            dynamic-application junos:YOUTUBE;
            ssl-encryption any;
          }
        then {
            deny;
          }
        }
        default-rule {
        deny;
        }
      }

Sample of configuration that controls access to an address over the Internet (HTTP) for site B.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
       policy Intent_4__1 {
        match {
            source-address ls-198.51.100.0/24-SP50-L3;
            destination-address addr2;
            application junos-http;
        }
        then {                          
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                 }
              }
           }
        }
        policy Intent_1__1 {
    	    match {
            source-address ls-198.51.100.0/24-SP50-L3;
            destination-address addr2;
            application junos-http;
      			 }
        	  then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_1;
                    }
                  }
               }
            }
          }
       }
from-zone Sales to-zone untrust {
			    policy Intent_4__0 {
      			  match {
            	  source-address ls-203.0.113.0/24-SP50-L4;
			           destination-address addr2;
                 application junos-http;
             }
           then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                  }
                }
              }
  		      }                                   
				   policy Intent_1__0 {
			        match {
      			      source-address ls-203.0.113.0/24-SP50-L4;
			            destination-address addr2;
            		application junos-http;
      					  }
					   then {
            		permit {
                		application-services {
                     application-firewall {
                     rule-set AppFwProfile_1;
                    }
                  }
                }
              }
            }
          }
	  policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_1 {
     rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
        match {
            dynamic-application junos:YOUTUBE;
            ssl-encryption any;
         }
         then {
            deny;
           }
          }
         default-rule {
         deny;
        }
       }
 rule-sets AppFwProfile_0 {
		  rule rule-00f3879c-f3d7-4cb3-89b6-78328e3bff38-appFwRule {
        match {
            dynamic-application junos:CNN;
            ssl-encryption any;
        }
        then {
            permit;
          }
        }
      rule rule-ca2354d6-a7ba-488e-8c5a-91cbddfb9583-appFwRule {
        match {
            dynamic-application junos:YOUTUBE;
            ssl-encryption any;
             }
         then {
            deny;
             }
           }
          default-rule {
          deny;
         }
       }

Example 8: Firewall Policy that Permits or Denies the Use of HTTP or FTP as a Service

Define a firewall policy where a specific IP address that belongs to the IT department is permitted or denied the use of HTTP or FTP as a service.

Table 16 shows the firewall policy intents that are needed to fulfil this requirement:

Table 16: Firewall Policy Intent Definition for Example - 8
Source	Service	Destination	Action
192.0.2.0	HTTP	example.com	Permit
192.0.2.0	FTP	example.com	Deny

Table 17 shows how this firewall policy intent is resolved:

Table 17: Firewall Policy Intent Resolution for Example - 8
Source Department	Source Address	Zone	Destination Address	Service
IT, site A	192.0.2.0	Trust/Untrust	example.com	FTP
IT, site A	192.0.2.0	Trust/Untrust	example.com	HTTP

Configuration Output Example

Sample of configuration that allows access to HTTP

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone IT to-zone trust {
      policy Intent_1__1 {
        match {
            source-address 192.0.2.0;
            destination-address example.com;
            application junos-ftp;
        }
        then {
            deny;
        }
      }
      policy Intent_4__1 {
        match {
            source-address 192.0.2.0;
            destination-address example.com;
            application junos-http;
          }
          then {
            permit;
          }
        }
      }
     policy-rematch;

Example 9: Firewall Policy that Denies Access to BitTorrent to the Finance Departments across both Site A and Site B

Define a firewall policy that denies access to BitTorrent for the Finance departments in site A and Site B.

Table 18 shows the firewall policy intents that are needed to fulfil this requirement:

Table 18: Firewall Policy Intent Definition for Example - 9
Source	Destination	Action
site A, Finance department	BitTorrent	Deny
site B, Finance department	BitTorrent	Deny

Table 19 shows how this firewall policy intent is resolved:

Table 19: Firewall Policy Intent Resolution for Example - 9
Site	Source Address	Zone	Destination Application	Service	Application Firewall Profile
Finance department, site A	[LS2]	Trust/Untrust	BitTorrent	Any	AppFwProfile_0 Deny: BitTorrent Def. Rule : Deny
Finance department, site B	[LS3]	Trust/Untrust	BitTorrent	Any	AppFwProfile_0 Deny: BitTorrent Def. Rule : Deny

Configuration Output Example

Sample of configuration that allows site A access to BitTorrent.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
      policy appQoe-36600-Permit-rule {
        match {
            source-address any;
            destination-address any;
            application appQoe-36000;
            }
        then {
            permit;
          }
       }
      policy Intent_1 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address any;
            application any;
             }
        then {                          
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                }
            }
            log {
                session-init;
                session-close;
                }
              }
           }
        }
       policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_0 {
     rule rule-2226740d-03a9-483c-b315-eddc9ae8619a-appFwRule {
        match {
            dynamic-application junos:BITTORRENT;
            ssl-encryption any;
        }
        then {
            deny;
          }
       }
         default-rule {
         deny;
        }
      }

Sample of configuration that allows site B to access to BitTorrent.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance1 to-zone untrust {
       policy appQoe-36600-Permit-rule {
          match {
            source-address any;
            destination-address any;
            application appQoe-36000;
           }
           then {
              permit;
           }
        }
      policy Intent_4 {
         match {
            source-address ls-198.51.100.0/24-SP50-L3;
            destination-address any;
            application any;
             }
          then {                          
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                 }
              }
            log {
                session-init;
                session-close;
               }
            }
         }
      }
      policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_0 {
     rule rule-00f3879c-f3d7-4cb3-89b6-78328e3bff38-appFwRule {
        match {
            dynamic-application junos:BITTORRENT;
            ssl-encryption any;
        }
        then {
            deny;
        }
      }
      default-rule {
         deny;
      } 
     }

Example 10: Firewall Policy that Allows Access to Facebook for Users in User Group A

Define a firewall policy where the users that are a part of user group A are provided access only to Facebook, and no other applications. User group A consists of users located in site A.

Table 20 shows the firewall policy intent that is needed to fulfil this requirement:

Table 20: Firewall Policy Intent Definition for Example - 10
Source	Destination	Action
user group A, site A	Facebook	Permit

Table 21 shows how this firewall policy intent is resolved:

Table 21: Firewall Policy Intent Resolution for Example - 10
Site	User/User Group	Source Address Range	Destination Address	Application
site A	user group A	192.0.2.0 to 192.0.2.20	Any	Facebook

Configuration Output Example

Sample of configuration that allows users in user group A access to Facebook.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
      policy appQoe-36600-Permit-rule {
        match {
            source-address any;
            destination-address any;
            application appQoe-36000;
         }
         then {
            permit;
            }
        }
      policy Intent_4__0 {
        match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address any;
            application any;
            source-identity "USERFW.LOCAL\Cert Publishers";
            }                               
        then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                }
            }
            log {
                session-init;
                session-close;
               }
            }
         }
      }
from-zone IT to-zone untrust {
      policy appQoe-36600-Permit-rule {
        match {
            source-address any;
            destination-address any;
            application appQoe-36000;
           }
        then {
            permit;
           }
        }
       policy Intent_4__1 {
         match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address any;
            application any;
            source-identity "USERFW.LOCAL\Cert Publishers";
          }
          then {
            permit {
                application-services {
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                }
            }
            log {
                session-init;
                session-close;
                }
             }
          }
       }
     policy-rematch;

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_0 {
     rule rule-00f3879c-f3d7-4cb3-89b6-78328e3bff38-appFwRule {
        match {
            dynamic-application junos:FACEBOOK-APP;
            ssl-encryption any;
        }
        then {
            permit;
        }
      }
      default-rule {
        deny;
      }
    }

The hierarchy level for the following configuration sample is [edit services user-identification identity-management].

content_copy zoom_out_map
connection {
       connect-method https;
       port 443;
       primary {
           address 10.213.50.50;
           client-id 1234;
           client-secret "$ABC123"; ## SECRET-DATA
           }
        token-api oauth_token/oauth;
        query-api user_query/v2;
        }  
        batch-query {
        items-per-batch 200;
        query-interval 5;
      } 
      ip-query {
      query-delay-time 15;
     }

Example 11: Firewall Policy that Permits User B in Site A Access to YouTube with Content Security Enabled

Define a firewall policy where the User B located in Site A is provided access only to YouTube with Content Security enabled. The user does not have permission to access any other applications.

Table 22 shows the firewall policy intent that is needed to fulfil this requirement:

Table 22: Firewall Policy Intent Definition for Example - 11
Source	Destination	Action
user B, site A	YouTube	Permit

Table 23 shows how this firewall policy intent is resolved:

Table 23: Firewall Policy Intent Resolution for Example - 11
Site	Source Address	User/User Group	Destination Address	Content Security	Application
site A	192.0.2.22	user B	Any	Enabled	Facebook

Configuration Output Example

Sample of configuration that allows user B in site A access to YouTube, with Content Security enabled.

The hierarchy level for the following configuration sample is [edit security policies].

content_copy zoom_out_map
from-zone Finance to-zone untrust {
      policy Intent_4__0 {
         match {
            source-address ls-192.168.1.0/24-SP50-L2;
            destination-address any;
            application any;
            source-identity "userfw.local\CSO1";
          }                               
         then {
            permit {
                application-services {
                    utm-policy testUTM;
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                }
            }
            log {
                session-init;
                session-close;
            	}
            }
         }
      }
from-zone IT to-zone untrust {
      policy Intent_4__1 {
        match {
            source-address ls-192.0.2.0/24-S42-L1;
            destination-address any;
            application any;
            source-identity "userfw.local\CSO1";
        }
        then {
            permit {
                application-services {
                    utm-policy testUTM;
                    application-firewall {
                        rule-set AppFwProfile_0;
                    }
                }
            }
            log {
                session-init;
                session-close;
              }
           }
        }
     }
    policy-rematch;

The hierarchy level for the following configuration sample is [edit security utm].

content_copy zoom_out_map
feature-profile {
       web-filtering {
           type juniper-local;
           }
         }
       utm-policy testUTM {
       web-filtering {
       http-profile junos-wf-local-default;
        }
       anti-spam {
        smtp-profile junos-as-defaults;
        }
    traffic-options {
        sessions-per-client {
            over-limit log-and-permit;
           }
        }
     }

The hierarchy level for the following configuration sample is [edit security application-firewall].

content_copy zoom_out_map
rule-sets AppFwProfile_0 {
     rule rule-00f3879c-f3d7-4cb3-89b6-78328e3bff38-appFwRule {
        match {
            dynamic-application junos:FACEBOOK-APP;
            ssl-encryption any;
        }
        then {
            permit;
        }
      }
      default-rule {
        deny;
       } 
     }

The hierarchy level for the following configuration sample is [edit services user-identification identity-management].

content_copy zoom_out_map
connection {
       connect-method https;
       port 443;
       primary {
          address 10.213.50.50;
          client-id 1234;
          client-secret "$ABC123"; ## SECRET-DATA
        }
       token-api oauth_token/oauth;
       query-api user_query/v2;
      }
     batch-query {
       items-per-batch 200;
       query-interval 5;
      }
     ip-query {
       query-delay-time 15;
    }

Example 12: Firewall Policy that blocks access to Internet and allow access to Google Drive.

The following section provides a sample firewall policy to block access to Internet and allow access to Google Drive. The firewall policy has one enterprise-based intent and one zone-based intent.

An enterprise-based intent to block access to Internet is provided in Table 24.

Table 24: Sample Enterprise-based Intent
Rule Name	Source Endpoint	Destination Endpoint	Action
EnterpriseIntent_1	Engg (Department)	Internet	Deny

A zone-based intent to allow access to Google drive is provided in Table 25.

Table 25: Sample Zone based Intent
Rule Name	Source Endpoint	Destination Endpoint	Action
ZoneIntent_1	Engg (Zone)	untrust(zone), google-drive	Allow

The intents in Table 24 and Table 25 result in firewall rules order that is provided in Table 26.

Table 26: Sample firewall rule
Rule Name	Rule Order	Source Endpoint	Destination Endpoint	Action
ZoneIntent_1	1	Engg (Zone)	untrust(zone), google-drive	Allow
EnterpriseIntent_1	2	Engg (Department)	Internet	Deny

arrow_backward PREVIOUS Selecting Firewall Destination

NEXT arrow_forward Firewall Policy Schedules Overview

Contrail Service Orchestration Customer Portal User Guide

ON THIS PAGE

Firewall Policy Examples

Example 1: Firewall Policy that Permits Traffic from Departments in Site A to the Departments in Site B

Example 2: Firewall Policy that Permits Internet Access for all Departments in Site A and Site B

Example 3: Firewall Policy that Permits Any Public Internet Address to Access the Sales Department in Site B

Example 4: Firewall Policy that Permits Social Media Access to all Departments in Site A

Example 5: Firewall Policy that Controls Access to Specific Applications for Various Departments

Example 6: Firewall Policy that Denies Access to Social Networking Sites

Example 7: Firewall Policy that Controls Access to an Address over the Internet (HTTP)

Example 8: Firewall Policy that Permits or Denies the Use of HTTP or FTP as a Service

Example 9: Firewall Policy that Denies Access to BitTorrent to the Finance Departments across both Site A and Site B

Example 10: Firewall Policy that Allows Access to Facebook for Users in User Group A

Example 11: Firewall Policy that Permits User B in Site A Access to YouTube with Content Security Enabled

Example 12: Firewall Policy that blocks access to Internet and allow access to Google Drive.

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Contrail Service Orchestration Customer Portal User Guide

ON THIS PAGE

Firewall Policy Examples

Example 1: Firewall Policy that Permits Traffic from Departments in Site A to the Departments in Site B

Example 2: Firewall Policy that Permits Internet Access for all Departments in Site A and Site B

Example 3: Firewall Policy that Permits Any Public Internet Address to Access the Sales Department in Site B

Example 4: Firewall Policy that Permits Social Media Access to all Departments in Site A

Example 5: Firewall Policy that Controls Access to Specific Applications for Various Departments

Example 6: Firewall Policy that Denies Access to Social Networking Sites

Example 7: Firewall Policy that Controls Access to an Address over the Internet (HTTP)

Example 8: Firewall Policy that Permits or Denies the Use of HTTP or FTP as a Service

Example 9: Firewall Policy that Denies Access to BitTorrent to the Finance Departments across both Site A and Site B

Example 10: Firewall Policy that Allows Access to Facebook for Users in User Group A

Example 11: Firewall Policy that Permits User B in Site A Access to YouTube with Content Security Enabled

Example 12: Firewall Policy that blocks access to Internet and allow access to Google Drive.

Related Documentation

Stay in touch