Firewall rules template
298 Avaya VPNmanager Configuration Guide Release 3.7
Medium Security. - Selecting medium security enforces the same security policy as high
security for all zones except the semi-private zone. The semi-pri vate zone with medi um security
is trusted the same as the private zone. That is, the same security policy that is enforced on the
private zone is enforced on the semi-private zone. In medium security, semi-private zone can
also access all the resources in the private zone.
Low Security. - Selecting low security enforces the same security policy as specified for
medium and the access from the internal network to the Internet is not limited to only the
common services. Access to all TCP and UDP services are allowed.
VPN-only Security. - Selecting VPN-only security enforces the security policies as specified at
the domain and device levels. The security policies are enforced at the tunnel end point. Using
VPN traffic is given a higher inbound and outbound priority than IKE traffic.
None. - Selecting None as the firewall template allows all traffic, VPN and non-VPN, through
the gateway. Security gateway policies are not enforced.
The details about rules and what types of traffic are al lowed and deni ed for each level and zone
are in the following tables.
Public zone firewall templates
The public network interface provides connection to the Internet and the security gateway
functions as the firewall/VPN gateway.
Usually the public interface has the strongest firewall policy. Few incoming packets are allowed
and outgoing packets are allowed only for commonly used services.
The public high security rules are enforced for both incoming and outgoing packets as follows.
Incoming traffic to the public zone allowed include:
●VPN packets from private, DMZ, Management or Semi-private zones
●ICMP unreachable packets
●Publicly accessible DMZ services allowed include ping, FTP , SSH, Telnet, HTTP, HTTPS,
POP3, IMAP, SMTP, NNTP and DNS.
All other incoming traffic is blocked.
Outgoing traffic from the public zone allowed include:
●Outgoing VPN traffic
●ICMP unreachable
●Ping from any IP to any