Firewall default rule

Darshil · June 2020

Hi Team,

I just wanted to know is it possible to delete auto added or default access rule in sonicwall firewall. I have tried by enabling "Enable the ability to remove and fully edit auto-added access rule" option is diag page and able to delete dafault rule but after restarting the firewall default rule is created automatically.

shiprasahu93 · June 2020

Hello @Darshil ,

That option in the diag page should do it. Which specific default rule are you talking about?

Also, what firmware version are you on?

Thanks!

fmadia · June 2020

Hi @Darshil ,

You should be able to but you have to make sure you disable also the cause that created the rule in the first place. Once you "Enable the ability to remove and fully edit auto-added access rule" and delete the default rule you should check why this was created (for example if it's a VPN rule, the checkbox under the VPN Policies to automatically create rules may be enabled) otherwise it will recreate the rule after the reboot.

Francesco

Darshil · June 2020

@shiprasahu93 we tried to deleted default IV4 and IPV6 rule which from LAN to WAN and we are running on latest firmware version 6.5.4.5

BWC · June 2020

Hi @Darshil

I'am not a friend of auto-generated rules as well, first thing I do when configuring a new appliance is disabling all of the "Auto-generate Access Rules to allow traffic between" options in every zone under Network -> Zones. This is taking care of a bunch of rules.

Just my €.02, maybe does not fit for everyone.

--Michael@BWC

Saravanan · June 2020

Hello @Darshil

I just tested the behavior on my TZ 500W running on 6.5.4.6-79n (latest build) and the symptom is exact same of what you reported. Upon disabling the option which is the cause of the access rule to be in there (according to @FMADIA), the access rule no more gets auto-added after a firewall restart.

If you are facing any difficulties to find the feature or cause for the access rule, please feel free to get in touch with our SonicWall Support team for real-time assistance on this.

https://www.sonicwall.com/support/contact-support/

Have a good one!!!

Darshil · June 2020

Hi Team,

We tried to delete below rule from VPN to DMZ but for dmz network not has been called in any VPN policy in firewall.

shiprasahu93 · June 2020

Hello @Darshil,

This is a auto-added management access rule for IPv6. Have you turned ON the HTTPS management check box in any of the VPN policies? It then adds this to all destination zone irrespective of the networks selected on the VPN.

I hope that helps.

Thanks!

Saravanan · June 2020

Hi @Darshil,

The rule is pertained to IPv6. You can try to disable the HTTPS management option on the DMZ interface in IPv6 view. This will affect only the IPv6 portion and has nothing to do with IPv4. Below are the sample screenshots for your reference.

After disabling the HTTPS management checkbox, please follow the delete process and restart the firewall to confirm the presence of access rule.

Note: In addition to the above, please ensure you haven't included the DMZ subnet in any of the VPN policies else, the rule's presence is expected.

Have a better one!!!

Darshil · June 2020

@Saravanan1990_V https management is disabled on DMZ zone for IPV6 for sure.

As per @shiprasahu93 said I will check whether Https management is enabled on any of VPN policy or not.

Darshil · June 2020

Hi Team,

I am able to delete all others rule which is added for management purpose but not able to delete below rule.

No WLAN group vpn is enable in firewall but still we are not ablle to delete this default rule

shiprasahu93 · June 2020

Hello @Darshil,

It looks like these rules are created for some custom zone CCTV. Is that zone still in use?

Also, does it not give you an option to delete these or errors out?

Thanks!

RedNet · June 2020

https://community.sonicwall.com/technology-and-support/discussion/comment/1619#Comment_1619

This is related to the fw MgMt auto rule ticked for a vpn your DMZ net is associated with.

check your VPN's your DMZ net is included in.

Edit the VPN and look at the last tab "advanced"

Management via this SA - uncheck https etc but be careful if you have any VPN's you manage the FW over create a manual rule to allow mgmt first.

Also I echo what @BWC said. I also check the below option in the same s"advanced" section as above:

Suppress automatic Access Rules creation for VPN Policy - but be careful if you do this on any VPN's you need to manually add the access rules you need for the VPN first.

Also in the /diag I check this in the "VPN" section

Disable Auto-added VPN Management Rules - check this box - but be careful if you have any VPN's you manage the FW over create a manual rule to allow mgmt first.

Saravanan · June 2020

Hi @Darshil,

I tested this in-house and found the same behavior is seen on my firewall too. I can delete the WLANGroupVPN rule and after the firewall restart, the rule comes in again.

The reason for the specific rule pertained to WLANGroupVPN is in there on the firewall no matter the WLANGroupVPN is enabled or disabled is because, the GroupVPN is by default enabled on the WLAN and WAN zones. This option is not editable from Network | Zones as shown in the below screenshot. This may be the default behavior as per the firewall design.

Darshil · June 2020

Thanks @sarvananan

But what about below rule was created for sonic point. we have no did sonicpoint configuration but still rule was showing for sonic point management.

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABD0AAAAwCAYAAAASJQG1AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAA1MSURBVHhe7Z1LqGRHGcd7KxhEDUQUQxBfA+JjJUoiEVRwk8aJBF2IGd2IxAeTWQiTa0tIIAiDI4jOItAQggs1kXEjzuLOLGQkMIsEZpXFXQxZZXF3sy7rq9f5qk6dM30f3edxf3/4MbfrVNU53VXnq6/+fe7chUEIIYQQQgghhBCaoTA9EEIIIYQQQgghNEtheiCEEEIIIYQQQmiWwvRACCGEEEIIIYTQLLU4PDw0AAAAAAAAAABzY3H//n0DAAAAAAAAADA3MD0AAAAAAAAAYJZgegAAAAAAAADALMH0AAAAAAAAAIBZgukBAAAAAAAAALME0wMAAAAAAAAAZgmmBwAAAAAAAADMEkwPAADYMvtmtViYhWJ18745WC+zMsfefqU9AMD4KGPYcn1QrdePxMelWb9bO3YMbq7M4vzaHNSOBfb3fAz2rw/M+rxc/8rsxzrvrs2y1kdX+RbIP9tT/HwA4Eyyc9Pj/bv3zDtXbpg7v/vXkZF20r7WLwAAjBVJ6lVC3YEk4sfbNAAA7JgNzIWx0jY9lmZ5XsXfwU0Pe0176jzyWWOIA8AJ2LnpcVzDIyLta/0CAMBY2cD0kGR6A2MEAGAMyJMInSatbNLTUwohrjmTZGVW7qkKSzIP9JMe8amLgN3ouycexJSIZcp0EPNC103ndnV8X6u95lqc0ZFdm5zXmx7rmyoGH9H0yK4j9OGuWxkV+rWu7z/D/FrLz7X3swYA2ICdmx41I+Oo1PoFAICxUvx6S+UbO57yAIBp0cS15qmJWK4M3PiUgjMbml/TaJ62aEyP0igQvOkRjYZgDkTzQtVN/RWmR6qjDIvm3EIwPez5Uxw+oumhad6D/hyac8jx9rmLa40Eg4a1AQBOCqYHAADsEJ/cNkmvRRJpvUkAAJgQYhakzXlhRqTNfzIjfHnz9EI0PRpjoGnbNkJiu9y4sMTzFqZHU6cxIbpMjxSLj2p6uHb+M9DGdttECeaGrmtZ3aysC4ryMwAAOCqYHgAAsFOaZN+/TomxqgMwX9QGr9gI75K4UR/q/LMjbuynbHqEY8u91eamhzM81HXr9x/q76f3Wn+PVTNcUzvvYLxn1q8/YVZv25/fvmoWr785kusaGjWGxVwHGAPO9EgLn2XbiWfNxOhi76lfuGu6/cIbWXmtX5gz9UXSLcxh4Y/zN5vDEnSLOZ0v9DAaXNKkxzEfbz/GPlmLZS4R1I8EZ+0tLLjjwd6LeeKtxteNfT62Zw09l2vHYdq0x/fBmwMd0/rzsq5N5APY5iZSx/Nwjs51ek6kzX4e49xYyudQjLWU+8+hqe/qZoZJWdY1d3y56y+Vq7quzmamh6/XjJ0vC9TmTVHmxrq4Xr1+l+/xYL2y565ca1an/bnsioNbF83i2kWzvhfLMD0ENyZHjGswAWL8Lu6/OcTsRROkpSAP1NtAmxd9XPvxy+YLn/isWxwxPaB9wzVzNV+81Rx2Qde2U4ttXhdGQ5lIhaAbx0rGbSljmeaAT9KkrBavXP0ZBOjZEBfRQD6OZ32s/Fxe7c0jqYCS2vhutjnYLNH0/R85b8tyvy1Q2QhX1+lYf4L4TV8T17JxlM83HQs5SDHWzfjqz8PPjdTWjlF5Hj0n5HPVddO53XnUPHP15TzqWlw7OW97Drlz1uZlEcsFuR59He4/Iy02TOVcy647XYO+1uJzqF3LThCD46JZXb9olrfeU2Vn3fTwc+Y4cQ1GjovddlxVjG5iVVF3YizyhWj7b0ybF9889zXz6k9eSa+/+8UnzasXXjFvPPcX8+lHHjP/vrh2wQ7TA8oESgfUcg6n11LHLrTyOs7psi6MhHJ8izI/bnnCtlzvtxI1oZZgAYyWOM+zeyAkj+VfXWhtFuexeZw1feMb16lUnpPnY36sZZPh54QfdxfvwhzJ/mpGLAux0MfFle3Dlp2/bJ5PbeQ6ujeYEnvL8lr/LbL327NOh9fQjR+7qa5pfnM82Rh1702zFFMj/uvKO0wPqXPtCbNwhCdDsnZ3zEo9MbJ/PfThjk2ME8Q1GDlhTOVX0vT6kdYiGdsY/9OXyvX1yfcpx2L9YWPBogym2RvbAtq8+PV3LpinvvIt97MYHA8/9BHzn0uvmc997FPmrz/7oyuXDwnTA8qFUydMefKkNgHB9HA3cLgxSbRGSpEge2Qs83Hz/8a5UEmm1Fg3/QCMl2bN1fPZJ49pbVb3Ryv5mOxm6GzQN74P2hzk+ZhPHNtjX8RBW960aWKn9JX9imDP3JE2ro/atXX0n45Hipie11PrdKwPnbixm+p9XptDE0J+tcU/4eGf+PCGRc300MctyewQo+Oqv+9s3aWt0+5vepwkrsHISbG7idPNeDd5uaub1pG+9UnVr+b6u2MRJ2nj2qiL3gLavLhx6TXzoQ88ZP57+e/mV9++YH709e+Zn37jGfPlR8+ZZx//vkOu59nHn87a1fqF+dN100ky1czfPPmLiUJM4joTNBiWaiBsxjmNm9STcU7BVCfOasHN+gEYK/kczhPJcpMYYp67B4r7wtWB8bHB+PZsDpr68lrmgIp3KWbm58jXQ4/0IX1lG2e1PqbXRZva/OrqX9dxFDE9b6fjNsBYyY2J3AApTI/siY68bXyi4+DWVfv6jllFMySrPyVOFtdg5KjYHdeNNMblupFyk471yeUrOvYLzf5t17T+esu2kyhtXghPfv6r5uWnL5nPPPKY+cdzfzZ/+/mfzJUfXE7IB/T7Z36Ttan1C2eAeBMVN13nnNX13I23Mqstz284JirI1sr0GO/vxcDaTvaryTfAWKklBG7Oq+TR1VWmh8XfD3kZjJBNxrdnc3Bc06O2xvWaHvKzmkvxvLW+uvpvUcT0jdsBjIXs11UCzqg4munhzZI79rV/4mP/ui2/Zdtdv5OfbyqcMK7ByMlit1930v/doteNdPwBpseI5kFueuxgkmrzQvjDD18wj3704+ZLnzzXOibIzcSvt4DHJ3fLbDPQk0wVN6dL+ux8IvEaIWVgDItqHKv6GKtknwV24vhkKV9Mh6JI3LZoLOSbWiHOaXUNrrwwONx1YfKNnY3Gtyd25e03Mz1a/dnXch63/vWZHumYv7aU4JbX1tF/Oh4pYjqmB0yN5smOWBaNjIrpoY0QqSvl8ddanCFi+womh/9rMKruxDhpXIORU+bjMpYp38jXIbeuuLp965OO/fb13nDzYuHfgHbq6hVPC21eCG/99p/m4Q9+2KyWv2wdEzA9QONusGITsqnpEec6idcICSaHi0MOFTwtDzI95HjTNrK9zSqcLtmGLMyFPKkK61R2P2+LYpFuxZHTopm/utwnlG8ViYK8fz2fiwQDRsiG49uxOfBrnY9ltWRTJ6ZNXT9HdFtBzuPK9DzO5rWf875+/hcZstjaOp+nFZt1PA9tZml6DB6rdkl9Ps+X5kkNXe6NkLsV08P+nD0ZotsWhoir1+57GpwsrsEEUGuLL/PrQ4pzMrYxvqe8pHt9SjExMuC8aP16y7bR5sVxqfULAABTpLZY2gRKb/LtIitlg5geY0z2sw0rAAzC4LFql5w10wMA5gamBwAADEf5rUJ4LX8uzX+zIMm23VSojX7+ZE/+TUP7T6aVybrU823q/ZSmR/wWS3+bOyTt6wOAATj1WNVVP5wrlVuiqZKVh/ru/OHPE4e6zdM5XX2qtvY9rGyMceUhNudP96g+AAAmws5Nj3eu3KgaGZsi7Wv9AgDABFEbBEfYSKT/ACseL+sFXDLuyv0jlNkjmK682/So91MxFTrODQBnmFOPVX31VQxL9W15MCWycvk3xbj8XNKn/7mvbW7C+FhYxlEAgGmxc9Pj/bv3jm18SDtpX+sXAACmR5OEh7K4gbA/+289Q6KdEv1QJ33raKltDFI/PaZHtR9MDwDYgFOPVR31y/gTX8u/uq4g/WT18/iX4m1f23gtuj6mBwBMnJ2bHgAAAIksQbeUG4B4LNZzmwKVfKf2RzQ9OvvB9ACADTjtWNVVv4w/XeXlcfe6x/ToaovpAQAzBNMDAACGQ28caq8jMUkvjrtvWF3y3v3tafOIdugnmh7VftqmR+tpFACA045VXfWlXP9KXjIsin7ktZSn41LWYXr0tVXXgOkBAHMB0wMAAAakYwNQ1lOJvNsMhEeyV3sdGwDdj9s0hDbuP/jzG4h6P6XpUW4OAAAsW4hV9frefIjljlCexbZYvpHp0dO2anroa1AGDADARMD0AACAQXHJdErSR0a2gQAAGJbMuAAAgI3A9AAAgIHxT1eMzlwQw4NvNQFgUEJ8jE9k1J4uAQCAXjA9AAAAAAAAAGCWYHoAAAAAAAAAwCzB9AAAAAAAAACAWYLpAQAAAAAAAACzZHF4eGgAAAAAAAAAAObGwiCEEEIIIYQQQgjNUJgeCCGEEEIIIYQQmqUwPRBCCCGEEEIIITRLYXoghBBCCCGEEEJolsL0QAghhBBCCCGE0CyF6YEQQgghhBBCCKFZCtMDIYQQQgghhBBCsxSmB0IIoS3rtnlpsTALxUv/C0deVOUv3vaFCCGEEEIInYqM+T/vPEDeA7yF3AAAAABJRU5ErkJggg==

It is my personal observation that so many unwanted rule was auto-created in sonicwall firewall which getting highlighted in audit.

Saravanan · June 2020

Hi @Darshil,

I apologize for the delay in response.

The rule shown by you belongs to Sonicpoint L3 Management. You can get rid of this rule by following the below steps.

Login to the SonicWall UI and navigate to diag page (https://firewallip/diag.html).
Under Firewall Settings section, please enable the checkbox, "Enable the ability to remove and fully edit auto-added access rules".
Under VPN Settings section, please enable the option "Disable Auto-added VPN Management Rules" and click on Accept. (When you enable VPN on the firewall, you have to manually define the rules for management purpose.)
Inside the SonicWall UI, please delete the VPN to DMZ Sonicpoint L3 Management rule.
Reboot the firewall if required to check if the rule still appears after restart; the deleted rule shouldn't appear any more.

I have tested the above steps in-house and confirmed that the rules do not persist.

Note: Please ensure to disable the checkbox "Enable the ability to remove and fully edit auto-added access rules" under Firewall Settings section in diag page and the option "Disable Auto-added VPN Management Rules" under VPN Settings section still be enabled.

Please try the steps and get back to us for instant help.

Have a good day!!!

Join the Conversation

Firewall default rule

Answers