This article provides information about how to permit/allow any application or traffic for a specific time only.
It maybe necessary to block some traffic for a time period and permit it otherwise or vice-versa. For example, an administrator might want to block unwanted traffic such as Torrent/Facebook/Chat or some other application traffic (could also be source/destination based traffic) during office hours and allow it otherwise. In this scenario, we need to set a schedule that allows a policy to be used for packet match checks during specific hours. Otherwise, the policy should remain inactive.
We can achieve this goal with the help of schedulers and security policies. It is a two step process which includes 1) Define a scheduler 2) Apply the scheduler to the security policy which blocks/allow the traffic. To understand this better, let us take an example. In this scenario, the user wants to block all traffic which is hitting a security policy from 8AM to 6 PM on weekdays (Monday-Friday). Below is the procedure to follow:
Define a scheduler for the required time - (in this example, from 8 AM to 6 PM daily, and excluded Saturday and Sunday)
user@host# set schedulers scheduler block_traffic daily start-time 08:00:00 stop-time 18:00:00
user@host# set schedulers scheduler block_traffic sunday exclude
user@host# set schedulers scheduler block_traffic saturday exclude
Hierarchical structure should be like this:
[edit schedulers]
user@host# show
scheduler block_traffic {
daily {
start-time 08:00:00 stop-time 18:00:00;
}
sunday exclude;
saturday exclude;
}
Define a policy and bind the policy with the scheduler which we have configured:
user@host# set security policies from-zone trust to-zone protected_resource policy trust_to_protected scheduler-name block_traffic
Hierarchy should look like:
[edit security policies]
user@host# show
from-zone trust to-zone protected_resource {
policy trust_to_protected {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
scheduler-name block_traffic;
}
Commit the configuration:
[edit]
user@host# commit
commit complete
This policy will now be in effect and block the traffic from trust to protected_resource only during the time mentioned in the scheduler. Other than this time, it will be deactivated and users will be able to access protected_resource from trust.
2020-07-02: Article reviewed for accuracy. Article is correct and complete.