3Com OfficeConnect 3C16771, User Manual, Page: 105 / 182

Policy Rules 105
The more specific, the better. For example, if traffic is being
allowed from the Internet to the LAN, it is better to allow
only certain machines on the Internet to access the LAN.
Once you have defined the logic of the rule, it is critical to
consider the security ramifications created by the rule:
■
Will this rule stop LAN users from accessing critical
resources on the Internet?
For example, if IRC is blocked, are there users that
require this service?
■
Is it possible to modify the rule to be more specific?
For example, if IRC is blocked for all users, will a rule
that blocks just certain users be more effective?
■
Will this rule allow Internet users access to resources on
the LAN in a manner that may create an undue security
vulnerability?
For example, if NetBIOS ports (UDP 137, 138, 139) are
allowed from the Internet to the LAN, Internet users
may be able to connect to PCs with file sharing
enabled.
■
Does this rule conflict with any existing rules?
Once you have answered these questions, to add rules
you type the information into the correct boxes in the
Policy Rules window.
a Action
Select the
Allow
or
Deny
option button depending on
the intent of the rule, as defined by item 2 in the
“Network Access Rule Logic List” on page 104 .
b Service
From the Service menu, select the IP protocol, as defined
by item 4 in the “Network Access Rule Logic List” on
page 104 . If the protocol is not listed, it is necessary to
first define it in the
Add Service
window.