Limitations of custom policies

Configuration coordination requirements

You must be careful that your configuration allows the network analysis and intrusion policies processing and examining a single packet to complement each other because preprocessing and intrusion inspection are so closely related.

  • If you disable a preprocessor in a custom network analysis policy but the system needs to evaluate preprocessed packets against an enabled intrusion or preprocessor rule, the system automatically enables and uses the preprocessor although it remains disabled in the network analysis policy web interface.

  • All packets, regardless of which network analysis policy preprocessed them, are subsequently matched to access control rules—and thus to potential inspection by intrusion policies—in their own process. Preprocessing a packet with a particular network analysis policy does not guarantee that the packet will be examined with any particular intrusion policy.

Performance optimization requirements

To get the performance benefits of disabling a preprocessor, you must make sure that none of your intrusion policies have enabled rules that require that preprocessor.

Access control policy configuration requirements

You must carefully configure your access control policy so it invokes the correct network analysis and intrusion policies to evaluate a particular packet.

  • Each packet's handling is governed by a network analysis policy and intrusion policy pair, but the system does not coordinate the pair for you.

  • Tailoring preprocessing using network analysis rules and custom policies is an advanced task due to the complexity of ensuring proper coordination between network analysis and access control rules.

By default, the system uses one network analysis policy to preprocess all traffic handled by managed devices using a single access control policy. The system matches packets to any configured network analysis rules in top-down order by rule number. Traffic that does not match any network analysis rule is preprocessed by the default network analysis policy.

A default network analysis policy governs the preprocessing of all traffic handled by the access control policy. Initially, the system-provided Balanced Security and Connectivity network analysis policy is the default.

For advanced users with complex deployments, you can tailor preprocessing to specific security zones, networks, and VLANs by assigning custom network analysis policies to preprocess matching traffic. To accomplish this, you add custom network analysis rules to your access control policy. Each rule has an associated network analysis policy that governs the preprocessing of traffic that matches the rule.

Tip

You configure network analysis rules as an advanced setting in an access control policy. Unlike other types of rules in the system, network analysis rules invoke—rather than being contained by—network analysis policies.

New access control policy: intrusion prevention
Diagram showing how a newly created access control policy in an inline intrusion prevention deployment initially handles traffic. In order: Security Intelligence, preprocessing, access control default action, network discovery, and finally intrusion inspection.
Simplified diagram showing how the network analysis policy (preprocessing) selection phase occurs before and separately from the intrusion prevention (rules) phase

In this scenario, an access control policy is configured with two network analysis rules and a default network analysis policy:

  • Network Analysis Rule A preprocessors matching traffic with Network Analysis Policy A. Later, you want this traffic to be inspected by Intrusion Policy A.

  • Network Analysis Rule B preprocessors matching traffic with Network Analysis Policy B. Later, you want this traffic to be inspected by Intrusion Policy B.

  • All remaining traffic is preprocessed with the default network analysis policy. Later, you want this traffic to be inspected by the intrusion policy associated with the access control policy's default action.

After the system preprocessors traffic, it can examine the traffic for intrusions. The diagram shows an access control policy with two access control rules and a default action:

  • Access Control Rule A allows matching traffic. The traffic is then inspected by Intrusion Policy A.

  • Access Control Rule B allows matching traffic. The traffic is then inspected by Intrusion Policy B.

  • The access control policy's default action allows matching traffic. The traffic is then inspected by the default action's intrusion policy.

Note that for a single connection, although the system selects a network analysis policy before an access control rule, some preprocessing (notably application layer preprocessing) occurs after access control rule selection. This does not affect how you configure preprocessing in custom network analysis policies.