Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1059 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

http, Web filtering policy and application policy have to be re-entered when going from Accept to Reject to Accept

Nicholas Miles

When I choose to go from Accept in a firewall rule to Reject (or Drop) and then back to Accept again I have to re-add the scan http, web policy, and application control.  Why does it not revert to what I had before choosing Reject?

 



This thread was automatically locked due to age.
  • 0

    Hi Nicholas,

    those features are not active in reject firewall rules. You are rejecting all traffic, so the none used parts of the configuration are dropped.

    Ian

  • 0 in reply to rfcat_vk

    Thanks Ian and I understand they aren't needed when the "Reject" option is used however it would be nice to not have to re-add those settings all back when choosing "accept". 

  • 0 in reply to Nicholas Miles

    Hi Nicholas,

    you would need to submit a feature request, but wouldn't be very hopeful of getting it implemented. just my thoughts.

    Ian

  • +1 in reply to Nicholas Miles

    When you switch between one and the other while editing the rule, it should display the setting again.

    However if you save the Reject and the load again, the settings would not be there.

    Our UI standard is that system does not save settings that do not apply to the rest of the settings.

     

    One reason, for example, is that you cannot delete a web policy if it is currently in use by any firewall rule.  So what if you had a firewall rule that was Accept with a web policy, then set to reject but still had the web policy attached (in case you switched back).  You'd be unable to delete the web policy yet there would be no obvious firewall rule using it.  And yes, it might be possible to write code so that it worked, but high complexity for a tiny feature is not usually worth it.