Enterasys Networks CSX6000 - Manual (Page 306)

USER’S GUIDE
306 CyberSWITCH
E XAMPLE OF AN IP F ILTER C ONFIGURATION
This example provides a simple filtering scenario in which a corporate LAN utilizes a
CyberSWITCH to provide WAN access to both dial-in devices as well as the global Internet. A
Netserver resides on the LAN to provide configuration support for the CyberSWITCH. Also on the
LAN are an anonymous FTP server and a WWW server.
The following are the requirements/restrictions to be addressed by IP filters:
•
No outside access allowed to the Netserver or the CyberSWITCH.
• The FTP and WWW servers must be accessible from anywhere.
• Corporate hosts (including dial-in devices) may initiate TCP-based sessions with the Internet,
but not vice-versa. This covers the main IP applications such as TELNET, FTP, SMTP server
and HTTP. An assumption for FTP is that the client program supports the “PASV” option, in
which the data-transfer TCP connection is initiated by the client.
• No UDP traffic.
The interface to the Internet is via a numbered IP interface, which has the following filter applied
to its Input stage. Using a final action of DISCARD, the strategy for the filter is to restrict everything
but an explicitly permitted set of traffic.
128.131.25.10 128.131.25.12 128.131.25.11
128.131.25.15
193.57.50.1
Remote User
Remote User
Remote User
Internet
FTP
Server
SFVRA
Manager
WWW
Server Host Host
Host Host
ISDN
CSX5500