Firewall Sample Configuration

 

Figure 3-1 XSR with Firewall Topology

 

 

 

 

 

 

220.150.2.32/28

 

Frame Relay S1

XSR-3020

220.150.2.35

220.150.2.37

 

 

 

Internet

206.12.44.16/28

 

 

FE1

 

FE2

 

 

 

 

 

 

 

 

 

 

220.150.2.17

 

 

 

 

 

 

 

 

 

Internal

 

 

 

 

 

 

220.150.2.36

 

220.150.2.16/28

DMZ

 

 

 

Web server

(HTTP)

220.150.2.19

Mail server

(SMTP)

220.150.2.18

In this configuration, the firewall provides protected access from the private to dmz networks. That is, access is restricted to Web and mail traffic only. The hosts in the private network are provided full access to the Internet but access is denied from the Internet to the private network. Also, all Java and ActiveX pages, IP options, IP broadcast and multicast packets are banned.

Begin by specifying network objects for private, dmz, and Mgmt networks:

XSR(config)#ip firewall network dmz 220.150.2.16 mask 255.255.255.240 internal XSR(config)#ip firewall network private 220.150.2.32 mask 255.255.255.240 internal

XSR(config)#ip firewall network Mgmt 220.150.2.35 mask 255.255.255.0 internal

Log only critical events:

XSR(config)#ip firewall logging event-threshold 3

Set policies between the dmz and external networks. Note that policy objects and names are case- sensitive and you must cite network names exactly:

XSR(config)#ip firewall policy a1 private dmz HTTP allow

XSR(config)#ip firewall policy a2 dmz private HTTP allow

XSR(config)#ip firewall policy a3 private dmz HTTP allow

XSR(config)#ip firewall policy a4 dmz private HTTP allow

Set the policies between the dmz and external networks:

XSR(config)#ip firewall policy a5 ANY_EXTERNAL dmz SMTP allow XSR(config)#ip firewall policy a6 dmz ANY_EXTERNAL SMTP allow XSR(config)#ip firewall policy a7 ANY_EXTERNAL dmz SMTP allow XSR(config)#ip firewall policy a8 dmz ANY_EXTERNAL SMTP allow

Set policies to allow any traffic from private to external and Mgmt networks:

XSR(config)#ip firewall policy a9 private ANY_EXTERNAL ANY_TCP allow XSR(config)#ip firewall policy Telnetsess Mgmt Mgmt Telnet allow bidirectional

Allow ICMP traffic to pass from the dmz to private, private to all external, and all external to private networks:

XSR(config)#ip firewall filter allowICMP private dmz protocol-id 1 XSR(config)#ip firewall filter allowICMP private ANY_EXTERNAL protocol-id 1 XSR(config)#ip firewall filter allowICMP ANY_EXTERNAL dmz protocol-id 1

XSR Getting Started Guide 3-13

Page 56 Page 58
Page 57
Image 57
Enterasys Networks XSR-3020 manual XSR with Firewall Topology
Page 56 Page 58

XSR-3020 specifications

Enterasys Networks XSR-3020 is a sophisticated Layer 2 and Layer 3 switch designed to meet the demands of modern networking environments. Known for its robust performance and versatility, the XSR-3020 is an ideal solution for enterprises that require high efficiency, comprehensive security, and network reliability.

This switch supports a variety of advanced technologies, making it suitable for both data center and edge deployments. One of its standout features is its scalability. The XSR-3020 can accommodate growing network demands by allowing for easy integration of additional modules. This capacity for expansion ensures that organizations can adapt their networks without the need for complete hardware replacements.

The XSR-3020 offers high-speed connectivity through its multiple gigabit Ethernet ports, providing up to 48 10/100/1000BASE-T ports in a single chassis. This high-density design optimizes the physical space and ensures that organizations can connect numerous devices simultaneously without sacrificing performance. Additionally, it supports Power over Ethernet (PoE), allowing users to power network devices, such as IP cameras and access points, directly through the switch. This feature streamlines installations and reduces the clutter of electrical wiring.

Security is a critical consideration in today’s network landscape, and the XSR-3020 addresses this need with robust security features. It incorporates advanced access control capabilities, enabling administrators to segment traffic and enforce policies effectively. The switch also supports 802.1X authentication, ensuring that only authorized devices can connect to the network.

In terms of management, the XSR-3020 is designed to simplify operations through its user-friendly interface and extensive support for management protocols. It offers native support for Simple Network Management Protocol (SNMP) and can be easily integrated with various network management systems, allowing for efficient monitoring and troubleshooting.

Another key characteristic of the XSR-3020 is its reliability. With features such as redundant power supplies and fans, the switch ensures high availability, minimizing downtime for critical applications. It is also built to withstand harsh conditions, making it suitable for diverse environments.

Overall, the Enterasys Networks XSR-3020 combines high performance, scalability, and security, making it an excellent choice for organizations looking to enhance their network infrastructure. Its comprehensive set of features positions it as a reliable backbone for any modern enterprise network, ensuring that businesses can operate efficiently and securely.
Top Page Image Contents