[Top][Contents][Prev][Next][Last]Search

Secure Access Firewalls

This appendix has the following sections:
Introduction to Secure Access Firewalls C-1
Uploading Firewalls
Applying a Firewall to an interface

Introduction to Secure Access Firewalls

Secure Access is a software option available for the MAX TNT. To purchase Secure Access, contact your Ascend distributor.

Firewalls are similar to packet filters, but they are more complex than filters, and typically change dynamically in response to characteristics of packets that pass through them. In general, a Firewall can be designed to notice the passage of a packet with some specific bit patterns, and in response to that packet, invoke rules that cause other rules to be created dynamically.

Uploading Firewalls

The Secure Access User's Guide explains how to use the Secure Access Manager (SAM) application to create a Firewall and load Firewalls. This section provides some background information about using the SAM to log into the MAX TNT and upload a Firewall.

Permissions requirements

The SAM has several command-line and permissions requirements that must be met to successfully load a Firewall. When loading to the MAX TNT, the SAM prompts for a user name and password, and uses the specified name and password to select a User profile. Or, if the MAX TNT unit allows access without a password, the SAM uses the default User profile. The User profile must meet the following requirements:

When the SAM has logged into the MAX TNT, it prints the following message in its status window:

Loading the Firewall

 When you load a Firewall, the MAX TNT creates a Firewall profile and assigns the profile the name of the Firewall. The MAX TNT does not allow the following characters in names:

If the Firewall name contains one of these characters, the character is replaced with an underscore in the name of the Firewall profile. A Firewall profile contains the following parameters (shown with sample settings):

You apply the Firewall to an interface by specifying this name, so the name must be unique across both Filter and Firewall profiles. If you create a duplicate name, either by uploading a Firewall or changing the name in a Filter or Firewall profile, an error message appears.

The Version and Data parameters are intended to be set only by the SAM. The Version parameter specifies the Firewall version; if you change its value in the Firewall profile, one of the following messages will probably appear:

The Data parameter contains information about the Firewall definition. If you list the Data parameter separately, it is displayed as a sparse array. For example:

The SAM File Save As dialog box contains a type labeled as follows:

This type represents a set of commands that can be directly piped into a MAX TNT command-line session to store the Firewall manually.

Diagnostic commands

The MAX TNT has a FWALLversion diagnostic-level command for displaying the Firewall versions supported by the current system software. For example:

The output shows all Firewall versions supported in the current code. The version numbers are separated by spaces. The SAM uses this information to ensure that Firewalls you upload are supported.

The MAX TNT also has a FWALLdblog diagnostic-level command for displaying Firewall messages. For example:

By default, the SAM causes a message to be generated for all packets blocked by a Firewall. Firewall messages are sent to the logging mechanism configured in the Log profile, such as Syslog or the console. (For details, see the MAX TNT Reference Guide.)

Applying a Firewall to an interface

For a Firewall to take effect, you must apply it to a LAN or WAN interface in the MAX TNT. In either case, settings in the Answer-Defaults profile and the relevant Connection profile affect application of the Firewall.

How the Answer-Defaults profile settings are used

Following are the Answer-Defaults settings related to Firewalls, shown with their default settings:

If the MAX TNT uses a local Connection profile for authentication, it does not use Firewalls set in the Answer-Defaults Session-Info subprofile.

If the MAX TNT relies on RADIUS for authentication, and the caller's RADIUS profile applies a filter or Firewall (or both), the filter or Firewall specified in the user profile is applied to each incoming packet and the MAX TNT does not use those set in the Answer-Defaults Session-Info subprofile.

If the MAX TNT relies on RADIUS for authentication, and the caller's RADIUS profile does not apply a filter or Firewall, and the Use-Answer-For-All-Defaults parameter is set to Yes in the Answer-Default profile, filters or Firewalls set in the Answer-Defaults Session-Info subprofile are applied to each incoming packet.

Filter persistence for Firewalls

Before Secure Access was supported, the MAX TNT simply constructed a filter on a WAN interface when the connection was established, and destroyed the filter when the connection was brought down, even if the connection just timed out momentarily. This works fine for static packet filters, but does not accommodate a Firewall. Filter-Persistence is needed to allow Firewalls to persist across connection state changes, although it is not needed for filters. If you do set Filter-Persistence for a static packet filter, the filter persists across connection state changes.

Note: Although you can apply a Secure Access Firewall as a Call-Filter, Filter-Persistence does not apply to Call-Filter Firewalls at this release. If the Call-Filter you require is relatively simple, you might want to implement it as a regular packet filter for performance reasons.

Applying a Firewall to a WAN interface

Following are the parameters related to applying a Firewall to a WAN interface (shown with their default settings):

Following is an example of applying a Firewall to a WAN interface:

See Filter persistence for Firewalls for information about applying a Firewall as a Call-Filter.

Applying a Firewall to a LAN interface

A Firewall on an Ethernet interface affects which packets are allowed to reach the Ethernet or leave the Ethernet for another interface. A Firewall applied to the Ethernet interface takes effect immediately. If you change the Firewall definition, the changes apply as soon as you load the new Firewall. Following is the parameter related to applying a Firewall to a LAN interface (shown with its default setting):

Note: Use caution when applying a Firewall to the Ethernet interface. You could inadvertently render the MAX TNT inaccessible from the local LAN.

Following is an example of applying a Firewall to a local network interface:


[Top][Contents][Prev][Next][Last]Search

techpubs@eng.ascend.com

Copyright © 1998, Ascend Communications, Inc. All rights reserved.