F5 FirePass, Administrator'S Manual

Page: 23 / 182

Deploying the FirePass Server
FirePass
™
Server Administrator Guide 2 - 3
Overview of the firewall configuration process
During the process of firewall configuration, you might consider opening
the firewall ports in phases. In the initial phase, you could focus on opening
the ports that allow access to the FirePass server from both inside and
outside the firewall when you specify the server’s host name in a Web
browser. In this initial phase, you might also open the ports for SMTP so
that the FirePass server can send email messages to the FirePass
administrator. For this initial phase, the following ports need to be opened:
• Assuming there is a firewall between the Internet and the FirePass server,
the firewall must allow inbound traffic on ports 80 (HTTP) and 443
(SSH) as a base configuration with a destination address of the publicly
accessible FirePass address.
• The firewall must also allow the FirePass server access to network
services such as NTP, DNS, and SMTP (on ports 123, 53, and 25). The
network services might be located on an external network (Internet), or
on the internal corporate network. The location of the network services
and your particular deployment scenario determines which firewall’s
ports must be open, assuming there is a firewall between the FirePass
server and these services.
• If there is a firewall between the FirePass server and the corporate LAN,
the firewall must allow traffic on ports 80, 443, and 661.
To verify that the FirePass server has access to DNS and SMTP services
after you have opened the ports and installed the FirePass server, you can
use the instructions in Testing network connectivity, on page 2-16.
After you have verified that the FirePass server has access to DNS and
SMTP services and that you can access the server from a Web browser from
either side of the firewall, then you can open up the specific ports that are
necessary for your particular deployment. See the following tables in this
section that describe the ports and services. For example, if you are using
LDAP for authentication, you must open ports 389 and 636. Here are some
other examples of application services you might need to support:
• To support My Files, the FirePass server needs access to Windows file
servers using Microsoft Networking (ports 135, 137, 138, 139).
• To support My Email, the FirePass server needs access to POP/IMAP
and LDAP (ports 110, 143, 389, 636).
• To support Host Access, the FirePass server needs access to Telnet (port
23).
The services are sometimes hosted locally behind a firewall, and sometimes
hosted remotely. If the services are hosted remotely, the external firewall
must allow the FirePass server to make connections to those services on
specific TCP/IP ports.
To allow access to the FirePass server from the Internet, you can create
either Network Address Translation (NAT) rules or port forwarding rules on
the firewall to forward inbound packets to the server. The advantage of
static NAT is that it does not require you to forward each individual port to