{"id":22853,"date":"2023-02-03T01:45:00","date_gmt":"2023-02-03T01:45:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=22853"},"modified":"2026-04-17T18:07:42","modified_gmt":"2026-04-17T18:07:42","slug":"nips-v5-6r10-policy-matching-mechanism","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/nips-v5-6r10-policy-matching-mechanism\/","title":{"rendered":"NIPS V5.6R10 Policy Matching Mechanism"},"content":{"rendered":"\n

The NIPS policy matching mechanism is blocking first. That is, when traffic is matched against all policies, if one policy is matched whose action is set to block<\/strong>, traffic is blocked.<\/p>\n\n\n\n

When configuring IPS policies, it is recommended that they should not be overlapped. For example, security zones should not be overlapped, and address objects should not have intersections. If policy overlapping occurs, data packets may match two policies simultaneously, thus causing failure to achieve the intended goal. The following shows several configuration errors and how to correct them.<\/p>\n\n\n\n

1. Configure an IP address whitelist whose action is set to unblock. Packets from the remaining IP addresses are blocked.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Problem description:<\/p>\n\n\n\n

Policy 2 is configured to permit packets from the IP segment in the whitelist to pass, and policy 1 is configured to block packets from the remaining IP segment. However, it is found that all IP addresses are matched against policy 1.<\/p>\n\n\n\n

Solution:<\/p>\n\n\n\n

Invert the IP segment in policy 1 to achieve the effect of whitelist configuration, as shown below.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

2. A false positive is generated due to a specified rule, so a whitelist is configured to permit packets from specified IP addresses to pass.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Problem description:<\/p>\n\n\n\n

A policy is configured not to match IP addresses in the whitelist against rule 10000. However, IP addresses in this whitelist are still matched with rule 10000.<\/p>\n\n\n\n

Solution:<\/p>\n\n\n\n

Add an exception rule as follows:<\/p>\n\n\n\n

(1) Choose Object<\/strong> > Rule<\/strong> > Exception Rule<\/strong>, and click New<\/strong>.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

(2) Configure an exception rule, click OK<\/strong>, and then click Apply Settings<\/strong> to save settings.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n
\n
\"Red<\/a><\/figure>\n<\/div>\n\n
\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Description<\/strong><\/p>\n\n\n\n