Black Box LWN600CM-1 Guia do Utilizador descarregar pdf (Página 125)

724-746-5500 | blackbox.com

Page 125

Chapter 9: Common Configuration Examples

Table 9-2. CTRL-click to select multiple services.

(Action) Source Destination Service‡ Action Logging* (Action)

[-any] [-any-]* DHCP-Server, DNS† Permit Off Click “Apply.”

Click “New.” [-any-] 10.0.0.0/8 [-any-] Deny Dropped Packets Click “Apply.”

Click “New.” [-any-] 172.16.0.0/12 [-any-] Deny Dropped Packets Click “Apply.”

Click “New.” [-any-] 192.168.0.0/16 [-any-] Deny Dropped Packets Click “Apply.”

Click “New.” [-any-] [-any-]

HTTP, HTTPS,

IKE, NAT-T

Permit Both Click “Apply.”

Click “New.” [-any-] [-any-] [-any-] Deny Dropped Packets Click “Apply.”

* You do not enable logging for DHCP and DNS services because they would generate too many log entries. You enable logging

for packets that SmartPath EMS VMA drops because of the enforcement of rules that deny traffic (Dropped Packets) and the log-

ging of

session initiation and termination (Both) for traffic permitted by policy rules.

†Because the source for DHCPDISCOVER and DHCPREQUEST messages does not yet have an IP address and the destination is

255.255.255.255 for broadcast traffic, both the source and destination IP addresses must be set as "[-any-]".

‡Press the SHIFT key while selecting multiple contiguous services, and the CTRL key while selecting multiple contiguous or non-

contiguous services. When you click Apply, SmartPath EMS VMA generates a separate rule for each service.

SmartPath EMS VMA adds new rules to the bottom of the rule list, so that if you enter the rules in the order presented above,

they will already be in the correct positions, as shown in Figure 9-15. The SmartPath AP firewall checks policy rules from top to

bottom and applies the first match that it finds.

Figure 9-15. Firewall policy rules.

NOTE: If you need to rearrange a set of policy rules, select the checkbox to the left of a rule, and then click the Up and Down

buttons on the right to move the selected rule to a new position.

The rules in this policy allow clients to access a DHCP and DNS server to get their network settings and resolve DNS queries so

that they can access the captive web portal. They deny traffic to all private IP address spaces, thus blocking access to the internal

network. Rules 7–9 allow HTTP and HTTPS traffic so that guests can browse the public network and they allow IKE and NAT-T

traffic so that they can make VPN connections back to their corporate sites. Finally, Rule 10 logs all outgoing packets that

SmartPath APs drop because the firewall blocked them.

1 2 ... 120 121 122 123 124 125 126 127 128 129 130 ... 191 192

Sem comentários

Black Box LWN600CM-1 Guia do Utilizador Página 125