Enterasys Networks CSX7000 Manuel d'utilisateur télécharger pdf (Page 306)

100

101

USER’S GUIDE

306 CyberSWITCH

EXAMPLE OF AN IP FILTER CONFIGURATION

This example provides a simple filtering scenario in which a corporate LAN utilizes a

CyberSWITCH to provide WAN access to both dial-in devices as well as the global Internet. A

Netserver resides on the LAN to provide configuration support for the CyberSWITCH. Also on the

LAN are an anonymous FTP server and a WWW server.

The following are the requirements/restrictions to be addressed by IP filters:

• No outside access allowed to the Netserver or the CyberSWITCH.

• The FTP and WWW servers must be accessible from anywhere.

• Corporate hosts (including dial-in devices) may initiate TCP-based sessions with the Internet,

but not vice-versa. This covers the main IP applications such as TELNET, FTP, SMTP server

and HTTP. An assumption for FTP is that the client program supports the “PASV” option, in

which the data-transfer TCP connection is initiated by the client.

• No UDP traffic.

The interface to the Internet is via a numbered IP interface, which has the following filter applied

to its Input stage. Using a final action of DISCARD, the strategy for the filter is to restrict everything

but an explicitly permitted set of traffic.

128.131.25.10

128.131.25.12

128.131.25.11

128.131.25.15

193.57.50.1

Remote User

Internet

FTP

Server

SFVRA

Manager

WWW

Server

Host

ISDN

CSX5500

1 2 ... 301 302 303 304 305 306 307 308 309 310 311 ... 728 729

Commentaires sur ces manuels

Pas de commentaire

Enterasys Networks CSX7000 Manuel d'utilisateur Page 306

Commentaires sur ces manuels