Enterasys Networks X-PeditionTM manual Log only critical events

Configuration Examples

Figure 16-14 XSR with Firewall Topology

		XSR		220.150.2.32/28
	Frame Relay	S1	220.150.2.35
Internet	206.12.44.16/28			FE1	220.150.2.37
		FE2
	220.150.2.17			Internal
	220.150.2.16/28		DMZ		220.150.2.36
	Web server			Mail server
	(HTTP)			(SMTP)
	220.150.2.19			220.150.2.18

Begin by configuring network objects for private, dmz and Mgmt networks:

XSR(config)#ip firewall network dmz 220.150.2.16 mask 255.255.255.240 internal XSR(config)#ip firewall network private 220.150.2.32 mask 255.255.255.240 internal

XSR(config)#ip firewall network Mgmt 220.150.2.35 mask 255.255.255.255 internal

Log only critical events:

XSR(config)#ip firewall logging event-threshold 2

Allow ICMP traffic to pass between private, dmz and EXTERNAL networks:

XSR(config)#ip firewall filter okICMP private ANY_EXTERNAL protocol-id 1 XSR(config)#ip firewall filter ICMP1 dmz ANY_EXTERNAL protocol-id 1 XSR(config)#ip firewall filter ICMP2 ANY_EXTERNAL dmz protocol-id 1

Set policies between the dmz, external and Mgmt networks. Note that policy objects and names are case-sensitiveand you must cite network names exactly:

XSR(config)#ip firewall policy exttodmzhttp ANY_EXTERNAL dmz HTTP allow bidirectional

XSR(config)#ip firewall policy exttodmzsmtp ANY_EXTERNAL dmz SMTP allow bidirectional

XSR(config)#ip firewall policy TelnetSESS private Mgmt Telnet allow bidirectional

Set a policy to allow any traffic to pass from private to EXTERNAL networks:

XSR(config)#ip firewall policy prvtoextprivate ANY_INTERNAL ANY_EXTERNAL allow after

Trial load the completed configuration into the firewall engine, and if successful, load the configuration:

XSR(config)#ip firewall load trial

XSR(config)#ip firewall load

Complete LAN and WAN interface configuration:

XSR(config-if<F1>)#interface fastethernet 1

XSR(config-if<F1>)#ip address 220.150.2.35 255.255.255.0

XSR(config-if<F1>)#no shutdown

XSR User’s Guide 16-25