Enterasys Networks X-PeditionTM manual Authentication Process

XSR Firewall Feature Set Functionality

•Flooding attacks (TCP, UDP, ICMP) logs

•Firewall start and restart

•Failures (out of memory)

A sample Web access (port 80) permit alarm, which logs at level 4, displays:

FW: Permit: Port-2, Out TCP Con_Req, 10.10.10.10(1042) -> 192.168.1.200(80)

FW: TCP new session request. 10.10.10.10(1042) -> 192.168.1.200(80)

FW: Permit: Port-1, TCP Con_Est, 192.168.1.200(80) -> 10.10.10.10(1042)

FW: TCP connection closed 192.168.1.200(80) -> 10.10.10.10(1042)

A sample client open connection to the FTP server (port 21) alarm displays:

FW: Permit: Port-1, Out TCP Con_Req, 10.10.10.10(1056) -> 192.168.1.100(21)

FW: TCP new session request. 10.10.10.10(1056) -> 192.168.1.100(21)

FW: Permit: Port-1, TCP Con_Est, 192.168.1.100(21) -> 10.10.10.10(1056)

The IP addresses cited in firewall alarms are selected as follows:

–If a syslog server is configured, alarms will contain the XSR IP address that is used to contact the syslog server.

–If no syslog server is configured, alarms will contain the IP address of the first circuit. FE1 will be checked first, then FE2, then any WAN interface until an IP address is obtained.

–If no interfaces have been configured with an IP address, the hostname will be used.

Authentication

AAAservices provide secure access across the firewall delineated by several levels: user, client and session. This release supports only client authentication which verifies a remote host based on its IP address. All firewall policy rules that specify allow-authas the action check the source IP address of the received packet in the auth cache before approving the session.

For the remote user, the XSR requires manual sign-on using Telnet to default port 3000 or another configured port. The user is prompted for a user name and password, and those credentials are checked with either an authenticating server (RADIUS) or local database on the XSR (see Figure 16-12).

Figure 16-12 Authentication Process

	Telnet server	1
Internet	3	4
2	Firewall	Internal
	DMZ
Authentication server		Servers
		XSR User’s Guide	16-17