Security Rule Set

Security Rule Sets group ordered security matches into reusable policy objects. Requires SD-WAN Manager 20.18.2 or later.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
feature_profiles	Class	feature_profiles	No

feature_profiles (sdwan)

Name	Type	Constraint	Mandatory	Default Value
policy_object_profile	Class	policy_object_profile	No

policy_object_profile (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
security_rule_sets	List	security_rule_sets	No

security_rule_sets (sdwan.feature_profiles.policy_object_profile)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,32}$	Yes
description	String		No
rules	List	rules	Yes

rules (sdwan.feature_profiles.policy_object_profile.security_rule_sets)

Name	Type	Constraint	Mandatory	Default Value
destination_data_ipv4_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
destination_data_ipv4_prefixes	List	IP	No
destination_data_ipv4_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
destination_data_ipv6_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
destination_data_ipv6_prefixes	List	IP	No
destination_data_ipv6_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
destination_fqdn_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
destination_fqdns	List	String[Regex: ^(?=.{1,120}$)((\*|[a-zA-Z0-9-]{1,63})\.)+([a-zA-Z0-9-]{2,63})$]	No
destination_fqdns_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
destination_geo_location_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
destination_geo_locations	List	Choice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]	No
destination_object_group	String	Regex: ^[^&<>! "]{1,32}$	No
destination_port_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
destination_ports	List	Integer[min: 0, max: 65535]	No
destination_ports_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ip_type	Choice	ipv4, ipv6	No	ipv4
protocol_name_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
protocol_names	List	Choice[snmp, icmp, tcp, udp, echo, telnet, wins, n2h2server, nntp, pptp, rtsp, bootpc, gdoi, tacacs, gopher, icabrowser, skinny, sunrpc, biff, router, ircs, orasrv, ms-cluster-net, kermit, isakmp, sshell, realsecure, ircu, appleqtc, pwdgen, rdb-dbs-disp, creativepartnr, finger, ftps, giop, rsvd, hp-alarm-mgr, uucp, kerberos, imap, time, bootps, tftp, oracle, snmptrap, http, qmtp, radius, oracle-em-vp, tarantella, pcanywheredata, ldap, mgcp, sqlsrv, hsrp, cisco-net-mgmt, smtp, pcanywherestat, exec, send, stun, syslog, ms-sql-m, citrix, creativeserver, cifs, cisco-sys, cisco-tna, ms-dotnetster, gtpv1, gtpv0, imap3, fcip-port, netbios-dgm, sip-tls, pop3s, cisco-fna, 802-11-iapp, oem-agent, cisco-tdp, tr-rsrb, r-winsock, sql-net, syslog-conn, tacacs-ds, h225ras, ace-svr, dhcp-failover, igmpv3lite, irc-serv, entrust-svcs, dbcontrol_agent, cisco-svcs, ipsec-msft, microsoft-ds, ms-sna, rsvp_tunnel, rsvp-encap, hp-collector, netbios-ns, msexch-routing, h323, l2tp, ldap-admin, pop3, h323callsigalt, ms-sql, iscsi-target, webster, lotusnote, ipx, entrust-svc-hand, citriximaclient, rtc-pm-port, ftp, aol, xdmcp, oraclenames, login, iscsi, ttc, imaps, socks, ssh, dnsix, daytime, sip, discard, ntp, ldaps, https, vdolive, ica, net8-cman, cuseeme, netstat, sms, streamworks, rtelnet, who, kazaa, ssp, dbase, timed, cddbp, telnets, ymsgr, ident, bgp, ddns-v3, vqp, irc, ipass, x11, dns, lotusmtap, mysql, nfs, msnmsgr, netshow, sqlserv, hp-managed-node, ncp, shell, realmedia, msrpc, clp]	No
protocols	List	Integer[min: 0, max: 255]	No
sequence_id	Integer	min: 1, max: 65535	Yes
source_data_ipv4_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
source_data_ipv4_prefixes	List	IP	No
source_data_ipv4_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
source_data_ipv6_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
source_data_ipv6_prefixes	List	IP	No
source_data_ipv6_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
source_geo_location_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
source_geo_locations	List	Choice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]	No
source_object_group	String	Regex: ^[^&<>! "]{1,32}$	No
source_port_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
source_ports	List	Integer[min: 0, max: 65535]	No
source_ports_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: This Rule Set drops traffic from the named Object Group and from a separate subnet match. Define matches under rules with ip_type and the appropriate source_data_ipv4_prefixes, source_data_ipv6_prefixes, destination_data_ipv4_prefixes, or destination_data_ipv6_prefixes fields.

sdwan:
  feature_profiles:
    policy_object_profile:
      security_object_groups:
        - name: restricted-sources
          ip_type: ipv4
          data_ipv4_prefixes:
            - 10.130.0.0/24
      security_rule_sets:
        - name: web-rules
          rules:
            - sequence_id: 1
              ip_type: ipv4
              source_object_group: restricted-sources
            - sequence_id: 2
              ip_type: ipv4
              source_data_ipv4_prefixes:
                - 10.131.0.0/24