Cisco Cisco TelePresence Video Communication Server Expressway 관리 매뉴얼
Intrusion Protection
Configuring Firewall Rules
Firewall rules provide the ability to configure IP table rules to control access to the VCS at the IP level. On the VCS,
these rules have been classified into groups and are applied in the following order:
these rules have been classified into groups and are applied in the following order:
■
Dynamic system rules: these rules ensure that all established connections/sessions are maintained. They also
include any rules that have been inserted by the automated detection feature as it blocks specific addresses.
Finally, it includes a rule to allow access from the loopback interface.
include any rules that have been inserted by the automated detection feature as it blocks specific addresses.
Finally, it includes a rule to allow access from the loopback interface.
■
Non-configurable application rules: this incorporates all necessary application-specific rules, for example to
allow SNMP traffic and H.323 gatekeeper discovery.
allow SNMP traffic and H.323 gatekeeper discovery.
■
User-configurable rules: this incorporates all of the manually configured firewall rules (as described in this
section) that refine — and typically restrict — what can access the VCS. There is a final rule in this group that
allows all traffic destined for the VCS LAN 1 interface (and the LAN 2 interface if the Advanced Networking
option key is installed).
section) that refine — and typically restrict — what can access the VCS. There is a final rule in this group that
allows all traffic destined for the VCS LAN 1 interface (and the LAN 2 interface if the Advanced Networking
option key is installed).
There is also a final, non-configurable rule that drops any broadcast or multicast traffic that has not already been
specifically allowed or denied by the previous rules.
specifically allowed or denied by the previous rules.
By default any traffic that is destined for the specific IP address of the VCS is allowed access, but that traffic will be
dropped if the VCS is not explicitly listening for it. You have to actively configure extra rules to lock down the system
to your specifications.
dropped if the VCS is not explicitly listening for it. You have to actively configure extra rules to lock down the system
to your specifications.
Note that return traffic from outbound connections is always accepted.
User-configured rules
The user-configured rules are typically used to restrict what can access the VCS. You can:
■
Specify the source IP address subnet from which to allow or deny traffic.
■
Choose whether to drop or reject denied traffic.
■
Configure well known services such as SSH, HTTP/HTTPS or specify customized rules based on transport
protocols and port ranges.
protocols and port ranges.
■
Configure different rules for the LAN 1 and LAN 2 interfaces (if the Advanced Networking option key is
installed), although note that you cannot configure specific destination addresses such as a multicast
address.
installed), although note that you cannot configure specific destination addresses such as a multicast
address.
■
Specify the priority order in which the rules are applied.
Setting Up and Activating Firewall Rules
The Firewall rules configuration page is used to set up and activate a new set of firewall rules.
The set of rules shown will initially be a copy of the current active rules. (On a system where no firewall rules have
previously been defined, the list will be empty.) If you have a lot of rules you can use the Filter options to limit the set
of rules displayed. Note that the built-in rules are not shown in this list.
previously been defined, the list will be empty.) If you have a lot of rules you can use the Filter options to limit the set
of rules displayed. Note that the built-in rules are not shown in this list.
You can then change the set of firewall rules by adding new rules, or by modifying or deleting any existing rules. Any
changes made at this stage to the current active rules are held in a pending state. When you have completed making
all the necessary changes you can activate the new rules, replacing the previous set.
changes made at this stage to the current active rules are held in a pending state. When you have completed making
all the necessary changes you can activate the new rules, replacing the previous set.
23
Cisco TelePresence Video Communication Server Administrator Guide