Configure Policies for Firebox-Generated Traffic

In Fireware v12.2 or higher, you can add policies to control Firebox-generated traffic. For a description of Firebox-generated traffic, go to About Policies for Firebox-Generated Traffic.

Before the policy can take effect, you must enable the Enable configuration of policies for traffic generated by the Firebox global setting. If you do not enable this global setting, any policies you create for Firebox-generated traffic do not take effect. For an explanation of how to configure this setting, go to Define Firebox Global Settings.

In the policy you add, you must specify the alias Firebox or an alias that includes the Firebox alias.

Proxy actions are not supported for Firebox-generated traffic.

As a best practice, we recommend that you do not create deny policies for Firebox-generated traffic.

  1. Select Firewall > Firewall Policies.
  2. Click Add Policy.
  3. Do one of the following:
    • From the Packet Filter drop-down list, select an option.
    • From the Custom drop-down list, select a custom policy template.
      You can add a custom policy template to specify more than one port number in a policy. For an explanation of how to add custom policy templates, go to Create or Edit a Custom Policy Template.

Screen shot of a custom policy template

  1. Click Add Policy.
  2. In the Name text box, type a name for the policy.
  3. In the From list, select Any-Trusted. Click Remove.
  4. After the From list, select Add.
  5. From the Member Type list, select Alias.
  6. Select Firebox or an alias that includes the Firebox alias.
  7. Click Add.
  8. Click OK.
  9. From the To list, click Add.
  10. From the Available Members list, select a destination.

Screen shot of a policy for Firebox-generated traffic

  1. (Optional) To configure SD-WAN:
    1. Select the SD-WAN tab.
    2. Select an SD-WAN action that you previously created, or select Create new.
      For information about creating a new SD-WAN action, go to Configure SD-WAN.
      Screenshot of SD-WAN Action drop-down list
  2. (Optional) To set the source IP address for Firebox-generated traffic:
    1. Select the Advanced tab.
    2. In the NAT section, select Dynamic NAT.
    3. Select All Traffic in this Policy.
    4. In the adjacent text box, type the source IP address.

    Screen shot of the Set source IP settings

  3. Click Save.
  1. Click Add Policy button.
    Or, select Edit > Add Policies.
    The Add Policy dialog box appears.
  2. From the Packet Filters drop-down list, select an option.
  3. Do one of the following:
    1. Click Add Policy.
    2. Expand Custom, select a custom policy template, and click Add Policy.
      You can add a custom policy template to specify more than one port number in a policy. For an explanation of how to add custom policy templates, go to Create or Edit a Custom Policy Template.

Screen shot of a custom policy template

  1. In the Name text box, type a name for the policy.
  2. In the From list, select Any-Trusted. Click Remove.
  3. After the From list, select Add.
  4. From the Available Members list, select Firebox or an alias that includes the Firebox alias.
  5. Click Add.
  6. Click OK.
  7. After the To list, click Add.
  8. Select a destination.
    You can select a member from the Available Members list, or select Add SNAT, Add User, or Add Other.
  9. To add more To destinations, repeat these steps.
  10. Click OK.

Screen shot of a policy in Policy Manager

  1. (Optional) To configure SD-WAN:
    1. Select Route outbound traffic using.
    2. From the drop-down list, select SD-WAN Based Routing.
    3. To select an SD-WAN action that you previously created, select it from the SD-WAN action drop-down list.
    4. To add a new SD-WAN action, click the New SD-WAN action button.
    5. To edit an SD-WAN action, click the Edit SD-WAN action button.

Screenshot of SD-WAN Based Routing drop-down list and SD-WAN Action drop-down list

  1. (Optional) To set the source IP address for Firebox-generated traffic:
    1. Select the Advanced tab.
    2. In the NAT section, select Dynamic NAT.
    3. Select All Traffic in this Policy.
    4. In the adjacent text box, type the source IP address.

Screenshot of NAT section of Advanced tab to set source IP address

  1. Click Save.

For configuration examples, go to Configuration Examples for Control of Firebox-Generated Traffic.

Related Topics

About Policies for Firebox-Generated Traffic

Configuration Examples for Control of Firebox-Generated Traffic

Define Firebox Global Settings