Add "Ignore" option to Network Control Rule "Action" options

[bnystrom]

Wishlist Request:
Request addition of an “Ignore” option to the “Action” field for Network Control Rules to allow passive logging of Traffic of Interest, and to temporarily disable a specific rule without the need to remove it.

Proposed Option Actions:
With “Ignore” option set for the Action field and “Log as a firewall event if this rule is fired” box checked, the conditions met event is logged, and the firewall goes on to consider the next Network Control Rule.

With “Ignore” option set for the Action field and “Log as a firewall event if this rule is fired” box left Unchecked, the firewall ignores this condition and goes on to consider the next Network Control Rule. This disables the rule, but leaves it in context so it could be re-enabled to Allow/Block this traffic if required.

Discussion:
Effectively monitoring “Traffic of Interest” requires a chronological record of events for tracking down anomalies or scrutinizing traffic from suspicious or untrustworthy sources. This data collection is best performed as it occurs without operator intervention. CIS Firewall (version 5.8.211697.2124) provides such chronological logging when a specific set of conditions (or attributes) pertaining to a packet of data are met, but further requires each packet be “Allowed” or “Blocked” at the time of detection. “Ask” option requires operator intervention in addition to requiring choice to Allow/Block.

If a user wishes to “toggle” a rule on/off they are currently required to remove the rule, then re-enter it. This introduces potential for error since the specific firewall rule conditions checked for and the exact ordering of the rules are critical to the correct operation of the firewall. Temporarily setting an “Ignore” option allows the exact rule to remain in the exact position for later re-enabling if desired.

[attachment deleted by admin]

[Amy666]

I second that.

Testing out new rules or check what existing ones do.
I am trying to master the firewall and defense+ (AV not installed) now for 4 days.
In both modules i would like to try out rules and disable them temporarily.
Right now my attempt is, to save the configuration, delete items and go back if something stops working.
But then i loose ALL my changes. But defining rules anew from the scratch AND putting them in the right order has proven to be a source of many errors in the last week (OK, actually the source of errors is me).
For not deleting the rules completely, i also tried out to put them at the end of the list all the way down.
But firstly this seems to confuse me even more ( cos i am not sure if the order matters everywhere e.g. defense+) and i am still loosing the original order.

Automatic data collection.
Also up to today i was wondering, that the system i use as a testbed showed only one entry in the firewall event log ever. Over years i developed the habit, if something strange happens or goes wrong, to check all logs along the normal execution path. So my old firewall and its logfile was a natural information source, because i am not logging networktraffic all the time with a dedicated tool e.g. from sysinternals, Nirsoft, …
Only today i discovered the “Log as a firewall event if this rule is fired” box. My first thought was, to define a rule for monitoring purpose, but for this i would need the suggested behavior.

I know that i am asking for a totally cluttered and overcrowded Rules list, resulting in a very large and busy event log, but (only as an option) this would be great in my learning phase right know and maybe later on in troubleshooting.