Amer-networks E5Web GUI Manual do Utilizador descarregar pdf (Página 243)

100

101

• Interface: wan

• Network: all-nets

• Gateway: isp_gw_ip

3. Click OK

3.11.5. Creating IP Rules or IP Policies

Before traffic can flow to the ISP, appropriate IP Rule objects must be created to allow the traffic

to pass. An alternative to using IP rules is to use IP Policy objects which can simplify this process if

other options such as application control are being added.

At minimum, DNS and HTTP traffic should be allowed to flow so that web surfing can take place.

It may also be necessary to use NAT to share the single external IP address assigned to the

Clavister Security Gateway so that the internal network topology of private IPv4 addresses is

hidden.

If, for example, web surfing is going to be done from clients on the internal network lan_net

attached to the lan interface to the public Internet connected to the wan interface, then the IP

rules for DNS and HTTP would be:

Action Src Interface Src Network Dest Interface Dest Network Service

NAT lan lan_net wan all-nets dns-all

NAT lan lan_net wan all-nets http-all

The service http-all includes both the HTTP and HTTPS protocols but not DNS so a second rule of

policy is needed. The single service all could have been used in a single rule but this is not

recommended as this means connections could be opened on any port number which can

compromise security. The best approach is to define the filter for traffic as narrowly as possible

which has been done here.

Example 3.44. Creating IP Policy Objects for Internet Access

This example creates an IP policy called surf_http that allows clients on the lan_net network to

access the public Internet. It is assumed that traffic is being NATed to the Internet using the

public IP address of the wan interface.

A second policy is also created called surf_dns which allows DNS queries.

Command-Line Interface

Create policy for the http-all service:

Device:/> add IPPolicy

SourceInterface=lan

SourceNetwork=lan_net

DestinationInterface=wan

DestinationNetwork=all-nets

Service=http-all

SourceAction=NAT

Name=surf_http

Repeat for the dns-all service:

Chapter 3: Fundamentals

243

1 2 ... 238 239 240 241 242 243 244 245 246 247 248 ... 776 777

Comentários a estes Manuais

Sem comentários

Amer-networks E5Web GUI Manual do Utilizador Página 243

Comentários a estes Manuais

Manuais e produtos relacionados com Acessórios para Computador Amer-networks E5Web GUI