General Information on Rule Templates

The IBM Firewall is shipped with a set of predefined rule templates. You can select from this list of preexising templates and you can also create your own. Rules on the Firewall are used to screen traffic passing through the Firewall. Rules can be set up to either allow or disallow traffic on the basis of certain criteria. The rule template function itself allows you to customize, add to, copy or delete existing rules. These rules, in turn, can be used to define Services. The figure below illustrates how rule templates are combined to make up services and how services can be components of connections.

Further Information

Using the Configuration Client to Create Rule Templates
Controlling Traffic Through the Firewall

Rule Name

Enter the rule name. The rule name should NOT contain a pipe symbol(|), a single quote (or apostrophe) character('), or a double quote(") character as these are used as SMIT and file delimiters. Use of these characters will result in unreliable data.

Description

This field is optional and is provided in case you want to provide a comment or additional information about this item.

Action

Select either Permit or Deny in the Action field to permit or deny access from a source to a destination. When a datagram comes into the filter, it compares the datagram specifications to each rule in the configuration file starting with the first rule until it finds a rule that matches exactly. Then it stops and performs the action (either permit or deny access) on that rule. If no match is found, the access is denied automatically.


Protocol

Select a protocol from the pull-down menu. The protocol specifies the internal protocol.

Operation

Specify an operation code to be used with the Port. The operation codes are:
       Any          
       Equal to     
       Not equal to
       Less than
       Greater than
       Less than or equal to
       Greater than or equal to
If you specify a value of "any" in the port operation field the port number field is not used in rule generation (and is set to 0 by rule creation code). If you specify a value for the port number field other than 0, Configuration Client processing will override the selection with 0 and inform you that it has done so.

Port #-ICMP (Source)

In the Source Port Number field, specify a port number. Enter the number of the port to be used in conjunction with the Source Port Operation Field. Any override that you apply to the preset default must be in the range 0-65535, inclusive. Note however,that the end values are only valid with a subset of the logical operators (see below).

The Source Port Operation and Source Port Number fields work together. In the operation field, select whether the port number of the requested service at the source host must be equal to, greater than, less than, equal to, less-than or equal-to, or greater-than or equal-to, the port specified in the Port Number Field.

For the icmp protocl, rather than specifying a source port specify an ICMP type and in place of a destination port specify icmp code. The logical operator specified is applied to the type or code and, as for ports, an operator of any, means that any type and/or code value will match this rule.

Note: The combination of operation and port number must result in a pair of fields that represent a valid "set" of values. So even though the values for the individual fields may be valid, the following combinations are considered invalid:
        Less Than                0
        Less than or equal to    0
        Equal to                 0
        Less than                1
        Greater than         65535

Port #-ICMP (Destination)

In the Destination Port Number field, specify a port number. Enter the number of the port to be used in conjunction with the Destination Port Operation Field. Any override that you apply to the preset default must be in the range 0-65535, inclusive. Note however,that the end values are only valid with a subset of the logical operators (see below).

The Destination Port Operation and Destination Port Number fields work together. In the operation field, select whether the port number of the requested service at the Destination host must be equal to, greater than, less than, equal to, less-than or equal-to, or greater-than or equal-to, the port specified in the Port Number Field.

For the icmp protocl, rather than specifying a Destination port specify an ICMP type and in place of a source port specify icmp code. The logical operator specified is applied to the type or code and, as for ports, an operator of any, means that any type and/or code value will match this rule.

Note: The combination of operation and port number must result in a pair of fields that represent a valid "set" of values. So even though the values for the individual fields may be valid, the following combinations are considered invalid:
        Less Than                0
        Less than or equal to    0
        Equal to                 0
        Less than                1
        Greater than         65535

Interface

In the Interface field, select the interface type from the pull-down menu.

Name (Interfaces)

Click "Select" and choose an adapter name. This field can only be used when the Interface adapter (previous field) is "specific". Otherwise, this field is not required.

Select

Press the "Select..." button to access a list of defined objects that are valid for this function.

Routing

In the Routing field, select one of these:

Direction

In the Direction field, select one of these:

Log Control

In the Log Control field, select either: When a log record is written for a filter rule, the values shown the log record are the actual values from the IP packet. Logging matched filter rules can provide valuable information about the content of IP packets seen by the Firewall, e.g., actual protocol and port numbers.

Frag. Control

In the Fragmentation Control field, select one of these:

Tunnel ID

In the Tunnel ID field, click Select to select from the tunnel list. Make your selection and click Apply or OK.

OK

Press the "OK" button to save changes and close the window.

Cancel

Press the "Cancel" button to close the window without saving any changes.