Prefilter policies

A prefilter policy is a security policy that

  • serves as the first security policy applied to incoming connections

  • evaluates traffic on layer 3/4 criteria only, including protocol and source/destination IP address and port

  • enables early decisions on connections to avoid further processing and improve device performance, and

  • can fast path connections and make them eligible for flow offload.

Prefilter policy actions

Use prefilter policies to implement these main actions:

  • Improve performance—The sooner you exclude traffic that does not require inspection, the better. Specifically, you can perform these actions.

    • Offload trusted flows—If your device supports flow offload, use the prefilter Fastpath action to identify flows you trust to be eligible for offloading to NIC processing. No further processing, including inspection, is needed for these connections. Refer to Best practices for fastpath prefiltering and Large flow offloads.

    • Block unwanted connections—For example, if you want to block entire subnets, protocols, or TCP/UDP ports, configure this in the prefilter policy.

  • Rezone plain text encapsulated tunnels so you can handle them as a unit in the access control policy. Some protocols, such as GRE, create plain-text tunnels that include many connections. By rezoning a tunnel, you assign it a tag, which you can select in access control rules as a source or destination zone. This allows you to apply customized intrusion or other rules to the tunneled traffic and provides granular insight and control.

    Note

    VPN or other encrypted tunnels are not plain-text tunnels and cannot be rezoned.

You must assign each access control policy a prefilter policy. However, the system comes with a pre-defined prefilter policy that might work for you.