Enterasys Networks CSX5500, CSX6000, CSX7000 Example of AN IP Filter Configuration, FTP WWW Sfvra

USER’S GUIDE

EXAMPLE OF AN IP FILTER CONFIGURATION

This example provides a simple filtering scenario in which a corporate LAN utilizes a CyberSWITCH to provide WAN access to both dial-in devices as well as the global Internet. A Netserver resides on the LAN to provide configuration support for the CyberSWITCH. Also on the LAN are an anonymous FTP server and a WWW server.

		FTP	WWW	SFVRA
Host	Host	Server	Server	Manager

Internet

128.131.25.10 128.131.25.12 128.131.25.11

128.131.25.15

193.57.50.1

Host Host

CSX5500

ISDN

Remote User Remote User

Remote User

The following are the requirements/restrictions to be addressed by IP filters:

•No outside access allowed to the Netserver or the CyberSWITCH.

•The FTP and WWW servers must be accessible from anywhere.

•Corporate hosts (including dial-in devices) may initiate TCP-based sessions with the Internet, but not vice-versa. This covers the main IP applications such as TELNET, FTP, SMTP server and HTTP. An assumption for FTP is that the client program supports the “PASV” option, in which the data-transfer TCP connection is initiated by the client.

•No UDP traffic.

The interface to the Internet is via a numbered IP interface, which has the following filter applied to its Input stage. Using a final action of DISCARD, the strategy for the filter is to restrict everything but an explicitly permitted set of traffic.

306 CyberSWITCH