3Com 3C16111 - SuperStack 3 Firewall Web Site Filter, User Manual

Page: 161 / 214

Using Network Access Policy Rules 161
Restoring the default rules will delete all custom rules and Public LAN
Servers. If an IKE VPN Security Association has been created, a service will
need to be recreated to permit IKE negotiations.
Protocols/Services to Filter
Although the Firewall is shipped in a safe mode by default, the user can
alter the Policy Rules and potentially cause the Firewall to be vulnerable to
attacks. Therefore, before any modifications are made, the user should be
aware of which services are of most risk to the private LAN.
The following table shows the protocols that are inherently vulnerable to
abuse and should be blocked from entering or leaving the site.
Table 6 Protocol Definitions and Characteristics
Protocol Name
Port
Number
Risk
TFTP-Trivial FTP 69 This protocol can be used to boot diskless
workstations, terminal servers and routers,
and can also be used to read any file on the
system, if set up incorrectly.
X Windows 6000+ This can leak information from X window
displays including all keystrokes.
DNS-Domain Names
Service 53 The DNS service contains names of hosts
and information about hosts that could be
helpful to attackers.
RIP-Routing
Information Protocol 520 This service can be used to redirect packet
routing.
UUCP-UNIX-to-UNIX
CoPy 540 If this service is not properly configured, it
can be used for unauthorized access.
Open Windows 2000 This protocol can also leak information
about what keystrokes are depressed.
RPC-Remote Call
Procedure 111 The RPC services, including NIS and NFS,
can be used to steal system information
such as passwords and read to write files.
Rexec
Rlogin
Rsh
512
513
514
These protocols can permit unauthorized
access to accounts and commands
Other services, whether inherently
dangerous or not, should be restricted to
only those systems that need them as
shown below:
DUA1611-0AAA02.book Page 161 Thursday, August 2, 2001 4:01 PM