Policy Creation

[sonydarrel]

I want to create a policy in which i want to specify the source port keeping a destionatin port for full open, is it possible becz when i click save it prompts me to enter the destination port.

thanks

[ede_pfau]

Sorry, I don't understand what your goal is. Can you please rephrase what 'keeping a destination port for full open' means, and what your policy looks like at the moment?

[MikePruett]

Is this an incoming policy or outgoing policy? I'm with EDE on being confused. I have ideas on what you mean if this is a incoming policy but even though we definitely need more info.

[sonydarrel]

Dears,

it is an incoming policy to explore more

source A from Interface A wants to reach to source B on interface B , the destination services for source B can be any  ( all services opens) but the source A which is coming from interface A should be match ip address  and services (8226 ) both

thanks

[emnoc]

I never seen a match on  service port in a firewall  So your flow is like this

srcA                           dstB

x.x.x.x:8226 -------> y.y.y.y:0 

Right ?

[Kenundrum]

You would need to create a custom service. With a source port of 8226 and destination ports 1-65535. There should be a checkbox in the GUI to specify source ports. Then go to the policy and set the appropriate source/destination with the service that you created and action accept.

For what it's worth- this does seem very strange and possibly opening a huge security hole, but it should be possible to do.

[emnoc]

Yes that would work &  the custom-service would be similar to the following

config firewall service custom

    edit "EXAMPLE1"

        set tcp-portrange 1-65535 8226 8226

    next

end

You would apply that in a policy but i'm really surprise a client would re-use the same ephemeral port. 

[pyy]

Hi ,

yes you can!

Create a new service object and specify as destination low=1 high 65535 and as a source the port that you want.

config firewall service custom     edit "test"         set tcp-portrange 1-65535 45500     next end