Avaya 3.7 manual DMZ zone firewall templates, DMZ high and medium security firewall rules

DMZ zone firewall templates

Table 40: Semi-private VPN-only security firewall rules (continued)

InBoundSemiPri	Permit	Any	Semi-Private	ICMPDESTUNREACHAB	In	Semi-Pri	No
vateAccessICM			-IP	LE		vate
P				ICMPTIMEEXCEEDED
OutBoundSemi	Permit	Semi-Privat	Any	ICMPDESTUNREACHAB	Out	Semi-Pri	No
PrivateAccessI		e-IP		LE		vate
CMP
InBoundSemiPri	Block	Any	Any	Any	In	Semi-Pri	No
vateBlockAll						vate
OutBoundSemi	Block	Any	Any	Any	Out	Semi-Pri	No
PrivateBlockAll						vate
							2 of 2

DMZ zone firewall templates

The Demilitarized Zone (DMZ) network interface is typically used to allow Internet users access to some corporate services without compromising the private network where sensitive information is stored. For all the services setup in the DMZ, access is allowed from any network, including Public, Private, Management and Semi-private. Because the DMZ is not a trusted network, all outgoing traffic is blocked.

The same security rules are enforced for high security, medium security, and low security. The DMZ high security rules are enforced for both incoming and outgoing packets as follows.

Incoming traffic from the DMZ zone is denied.

Outgoing traffic to the DMZ zone allowed includes

●Packets from the following networks: private, management, semi-private, and the destination is the servers with the common services.

Table 41: DMZ high and medium security firewall rules

Rule Name	Action	Source	Destination	Service	Direction	Zone	Keep	Description
							State
InBoundDMZ	Permit	DMZNet	Any	ActiveFTP	In	DMZ	Yes	Permit active FTP
ActiveFTPAc								data connection
cess								from FTP server
								on DMZNet to any
								FTP client on
								INATERNET(this
								works for both
								NAT/Non NAT
								setup)
InBoundDMZ	Deny	Any	Any	Any	In	DMZ	No	Deny the rest of
BlockAll								traffic
								1 of 2

Issue 4 May 2005 309