Hi,
my question is like https://community.sophos.com/products/unified-threat-management/astaroorg/f/110/t/70541
but in my case I created these ordered rules:
1)
* name (name) = Social_networking
* action (action) = block
* application list (applications)
1. BEBO
2. FACEBOOK
3. FBOOKAPP
4. FLIXSTER
5. FRNDFEED
6. FRNDSTER
7. LINKEDIN
8. MYSPACE
9. PLAXO
10. TWITTER
* group list (groups) = empty list
* destination network list (destination_networks)
1. any address object "Any"
* log (log) = 1
* comment (comment) = empty value
2)
* name (name) = LOG_ACTIVITY
* action (action) = accept
* application list (applications) = empty list
* group list (groups)
1. 3
2. Collaboration
3. Database
4. File Transfer
5. Games
6. Mail
7. Messaging
8. Network Monitoring
9. Networking
10. Proxy
11. Remote Access
12. Social Networking
13. Streaming Media
14. VPN and Tunneling
15. Web Services
* destination network list (destination_networks)
1. any address object "Any"
* log (log) = 1
* comment (comment) = empty value
My target is to log everythings and analyse the network activity in the future but meanwhile block the social networking traffic at all.
Thus I placed the social networking block at the top but with this configuration the logging rule (2) wins against the blocking rule (1).
Why is not respected the rule order?
