Moxa EDR-810-VPN-2GSFP [113/139] Cross conflict policy x cross conflicts with policy y

Industrial Secure Router User's Manual Firewall

8-9

Include: Policy [X] is included in Policy [Y]

The Source/Destination IP range or Source/Destination port number of policy [X] is less than or equal to policy

[Y], and the action target (Accept/Drop) is the same. In this case policy [X] will increase the loading of the

Industrial Secure Router and lower its performance.

For example, two firewall policies are shown in the following table:

Index Input Output Protocol Source IP Destination IP Target

1 WAN1 LAN All 10.10.10.10 192.168.127.10 ACCEPT

2 WAN2 LAN All 20.20.20.10

to 20.20.20.30

192.168.127.20 ACCEPT

Suppose the user next adds a new policy with the following configuration:

Index Input Output Protocol Source IP Destination IP Target

3 WAN2 LAN All 20.20.20.20 192.168.127.20 ACCEPT

After clicking the PolicyCheck button, the Industrial Secure Router will issue a message informing the user

that policy [3] is included in policy [2] because the IP range of policy [3] is smaller than the IP range of policy

[2], and the Target action is the same.

Cross Conflict: Policy [X] cross conflicts with Policy [Y]

Two firewall policy configurations, such as Source IP, Destination IP, Source port, and Destination port, in

policy [X] and policy [Y] are masked, and the action target (Accept/Drop) is different.

For example, two firewall policies are shown in the following table:

Index Input Output Protocol Source IP Destination IP Target

1 WAN1 LAN All 10.10.10.10 192.168.127.10 ACCEPT

2 WAN2 LAN All 20.20.20.20

to 20.20.20.30

192.168.127.25

Suppose the user next adds a new policy with the following configuration:

Index Input Output Protocol Source IP Destination IP Target

3 WAN2 LAN All 20.20.20.25 192.168.127.20

to 192.168.127.30

DROP

The source IP range in policy 3 is smaller than policy 2, but the destination IP of policy 2 is smaller than policy

3, and the target actions (Accept/Drop) of these two policies are different. If the user clicks the PolicyCheck

button, the Industrial Secure Router will issue a message informing the user that policy [3] is in Cross Conflict

with policy [2].