Bypass Rule

There is a special type of Firewall Rule called a Bypass Rule. It is designed for media intensive protocols where filtering may not be desired. You create a Bypass Rule by selecting "bypass" as the rule's "Action" when creating a new Firewall Rule.

The "Bypass" action on Firewall Rules differs from a Force Allow rule in the following ways:

• Packets matching Bypass will not be processed by Intrusion Prevention Rules
• Unlike Force Allow, Bypass will not automatically allow the responses on a TCP connection when Firewall Stateful Configuration is on (See below for more information)
• Some Bypass rules are optimized, in that traffic will flow as efficiently as if our Agent/Appliance was not there (See below for more information)

Using Bypass when Firewall Stateful Configuration is On

If you plan to use a Bypass Rule to skip Intrusion Prevention Rule processing on incoming traffic to TCP destination port N and Firewall Stateful Configuration is set to perform stateful inspection on TCP, you must create a matching outgoing rule for source port N to allow the TCP responses. (This is not required for Force Allow rules because force-allowed traffic is still processed by the stateful engine.)

All Bypass rules are unidirectional. Explicit rules are required for each direction of traffic.

Optimization

The Bypass Rule is designed to allow matching traffic through at the fastest possible rate. Maximum throughput can be achieved with (all) the following settings:

• Priority: Highest
• Frame Type: IP
• Protocol: TCP, UDP, or other IP protocol. (Do not use the "Any" option.)
• Source and Destination IP and MAC: all "Any"
• If the protocol is TCP or UDP and the traffic direction is "incoming", the Destination Ports must be one or more specified ports (not "Any"), and the Source Ports must be "Any".
• If the protocol is TCP or UDP and the traffic direction is "outgoing", the Source Ports must be one or more specified ports (Not "Any"), and the Destination Ports must be "Any".
• Schedule: None.

Logging

Packets that match the bypass rule will not be logged. This is not a configurable option.