Enterasys Networks CSX6000, CSX5500, CSX7000 manual Forward

CONFIGURING ADVANCED IP ROUTING

IP Filters

FORWARD	IP Src 0.0.0.0, 0.0.0.0		Permits any host to access the FTP
	IP Dst: 255.255.255.255,	128.131.25.10	Server.
	IP Prot: ANY
FORWARD	IP Src 0.0.0.0, 0.0.0.0		Permits any host to access the WWW
	IP Dst: 255.255.255.255,	128.131.25.12	Server
	IP Prot: ANY
FORWARD	IP Src 0.0.0.0, 0.0.0.0		Permits TCP traffic only from sessions
	IP Dst: 0.0.0.0., 0.0.0.0		which have already been initiated by
	IP Prot: TCP		corporate hosts.
	TCP Src Port: RANGE 0 65535
	TCP Dst Port: RANGE 0	65535
	TCP Control: ESTABLISHED
FORWARD	IP Src 0.0.0.0, 0.0.0.0		Permits all ICMP packets to enter (in-
	IP Dst: 0.0.0.0., 0.0.0.0		cluding ECHO packets for PING).
	IP Prot: ICMP
DISCARD	All other packet types		No-match action.

The corporate dial-in access is realized with a WAN Direct Interface, using a pool of IP addresses from the corporate LAN for dynamic assignment to the dial-in devices. These devices must first pass Authentication processing, so there is a level of security inherent on this interface that is not present on the Internet interface. Once authenticated, the devices are basically allowed to generate traffic in the same way that they can when operating from within the corporate LAN. This includes the ability to initiate TCP connections to the external Internet. Correspondingly, the strategy for this filter is different. Its purpose is to enforce the stated requirement of not allowing any external access to the Netserver or the CyberSWITCH itself.

DISCARD	IP Src 0.0.0.0, 0.0.0.0		Denies access to the Netserver.
	IP Dst: 255.255.255.255,	128.131.25.11
	IP Prot: ANY
DISCARD	IP Src 0.0.0.0, 0.0.0.0		Denies access to the CyberSWITCH it-
	IP Dst: 255.255.255.255,	128.131.25.15	self.
	IP Prot: ANY
DISCARD	IP Src 0.0.0.0, 0.0.0.0		Denies access to the CyberSWITCH it-
	IP Dst: 255.255.255.255,	193.57.50.1	self.
	IP Prot: ANY
FORWARD	All other packet types		No-match action

Now suppose that a situation arises in which it is temporarily necessary to allow remote access to the Netserver (for example, reconfiguration by a qualified member of staff who is offsite). Using the IP Address from which the temporary access will take place, this can be accomplished by enabling the Exception Filter. When traffic arrives from the Internet, the Exception filter will be executed first, thereby allowing an override of the existing conditions of the Input filter. The Exception filter would be set up as follows (the remote access is originated from address 201.55.89.100).

Central Site Remote Access Switch 307