We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

This Firmware Version Is End-Of-Support

Documentation for this product is no longer updated. Please see https://campus.barracuda.com/doc/71862301/ for further information on our EoS policy.

Protected IP Count Policies

  • Last updated on

Barracuda NG Firewall VF and SF units are licensed based on the number of IP addresses being protected by the gateway. For more information, see Licensing. This article explains the algorithms that are used to count the protected IP addresses. It also provides instructions on how to specify counting policies when creating and configuring firewall rules. 

In this article:

Protected and Unprotected Realms - General Overview:

protected_ips.jpg

Viewing the Number of Protected IPs

To view the number of protected IP addresses for a Barracuda NG Firewall, go to the Firewall > Dynamic page and click the Protected IPs tab. The table on this page provides information on the number of active licensed IP addresses. For more information on the Firewall > Dynamic page, see Dynamic Page.

Counting Policies

The following sections describe how IP addresses are counted for each type of connection.

General Case

Generally, the protected IP address counted is either the source or destination address, based on a comparison of the classification of incoming and outgoing interfaces. The valid preference is the following:   

  1. Internal (LAN)
  2. DMZ
  3. Unspecified
  4. External  

For example, if the realm weight is the same from Internal01 to Internal02, the source IP address is counted. The same applies, vice versa, from Internal02 to Internal01. 

Classification of Incoming and Outgoing Interfaces:

IncomingOutgoing
Trusted / Internal01/02DMZUnclassifiedUntrusted
Trusted / Internal01/02SrcSrcSrcSrc
DMZDstSrcSrcSrc
UnclassifiedDstDstSrcSrc
UntrustedDstDstDstSrc

On the Network page, you can specify the realm category of an IP address:

  1. Go to the Network page (Config > Full Config > Box > Network).
  2. Click Lock.
  3. In the IP Address Configuration table, double-click the IP address entry and select the realm weight from the Trust Level list. 

For more information on configuring IP addresses, see Network.


Uncounted IP Addresses

The following IP addresses are NOT taken into account:

  • Source AND destination are site-to-site tunnel addresses (VPN relaying - VPN Tunnels in Star-Shaped Topologies).
  • Destination is a broadcast or multicast address.
  • Firewall rule results in a Block or Deny action. 
  • Customers with legacy phion SF licenses, VPN users, and HTTP Proxy users are also not counted.

Any communication directed to the services running on the Barracuda NG Firewall gateway itself is not counted:

  • Mail Gateway
  • DNS Server/Forwarder
  • DHCP Server
Redirected Destination

If a redirection of the destination IP address is performed by the firewall rule (Dst NAT or Map), the translated destination IP address is counted as protected. 

Policy for Redirected Destination:

policy_3.png

Site-to-Site VPN

The counting preference of protected IP addresses for Site-to-Site VPN tunnels is specified as follows: 

  • Source is counted as a protected IP address if the destination is routed via the tunnel.
  • Destination is counted as a protected IP address if the source originates from the tunnel.

If both options apply, neither source nor destination is counted. For more information on site-to-site tunnels, see Site-to-Site VPN.

Example Policy for Site-to-Site tunnels:

policy_4.png

Client-to-Site VPN

Each client connected to a Client-to-Site VPN counts as a protected IP address.  

SSL VPN

The number of protected IP addresses is taken from the client database and from configured resources such as the DMZ network. For more information, see SSL VPN for the Barracuda NG Firewall. Counting is specified as follows: 

  • Source is counted as a protected IP address if the destination is routed via the tunnel.
  • Destination is counted as a protected IP address if the source originates from the tunnel. 

If both options apply, neither source nor destination is counted.

Specifying Counting Policies

When creating or configuring firewall rules, you can also specify IP address counting policies in the Advanced Firewall Rule Settings.  

  1. In the left navigation pane of the firewall rule editor window, click Advanced from the Views menu.
  2. In the Miscellaneous section, select one of the following options from the Policy list:
    • Count Source IP – Source is chosen as the protected IP address if the rule explicitly requests it.
    • Count Destination IP – Destination is chosen as the protected IP address if the rule explicitly requests it.
The source and destination are interchanged if the rule matches on reverse.

edit_rule.jpg.png

Last updated on