EFW System Security
11
Proxying EFW Traffic Through a Perimeter Firewall
Multiple proxies are required to proxy EFW-related traffic through a perimeter firewall.
Assuming use of the default port settings, the following scenarios describe the various
proxy requirements.
■
A Policy Server inside a perimeter firewall that controls NICs in DMZ or external
networks (or a remote Policy Server controlling internal NICs) requires a single UDP
proxy on a port range from 2081 to 2082.
■
A Policy Server in one network that is behind a firewall, and a Management Console
in an external network that controls a Policy Server through the firewall requires three
proxies:
■
2072 TCP: Control messages/replication
■
2074 TCP: Java RMI
■
2073: Certificate Authentication
■
Policy Servers in the same EFW domain that need to synchronize through a perimeter
firewall require five proxies:
■
2072 TCP: Control messages
■
2073 TCP: Certificate Authentication
■
2074 TCP: Java RMI
■
2075 TCP: First Backup Server Replication
■
2078 TCP: Second Backup Server Replication
Using IPSEC Under Windows 2000
Windows 2000 supports host-to-host IPSEC (IP Security). As an added benefit, the
3CR990 NIC off loads IPSEC cryptographic processing from the operating system, which
enhances IPSEC performance. EFW treats IPSEC like any other protocol: it can permit or
deny it. Be aware that any protocol can be tunneled through IPSEC, and EFW does not
filter the protocols inside that tunnel. To specifically allow the use of IPSEC in your policies,
use the Windows 2000 IPSEC predefined rule set (see Appendix A).
EFW System Security
This section discusses the security features incorporated in the EFW system to ensure
security of both data and EFW operations.
Data Security
The data that is managed by the Policy Server is critical to the security of your network.
Therefore, the EFW system implements the following security features to protect your data:
■
EFW administrator login and password
Any access to the EFW Management Console requires a login and password, which
are valid for accessing any data in an EFW domain. Administrator login names and
passwords are managed under the Tools menu. The EFW system is shipped with a
built-in default login name of “admin” and with a password of “admin.”
CAUTION:
When you place your EFW system into production use, disable the
default login-password pair. For example, you can change the password for
“admin” to something known only to authorized EFW administrators. You may
also add a new user-password pair and then delete this default user.
