MDS 05-6628A01, Rev. B
MDS Orbit MCR-4G Technical Manual
45
The following example describes the step-by-step configuration of an example filter that can be applied to
cellular interface of the MCR. Change to CLI configuration mode:
1. Enable firewall service
admin@(none) 19:33:20% set services firewall enabled true
2. Create a “restrictive” filter named “IN_UNTRUSTED” to indicate that this filter has been
designed to be applied to an untrusted cellular interface of MCR. The cellular interface can be
considered untrusted as it is connected to public cellular network, which is inherently an untrusted
network.
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED
3. Create rule to permit encrypted IPsec tunnel traffic i.e. traffic with protocol=ESP
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 1 match protocol esp
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 1 actions action accept
4. Create rule to permit traffic for the following UDP services: DNS, NTP and IKE (to allow IPsec
connection setup).
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 2 match protocol udp
src-port services [ dns ike ntp ]
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 2 actions action accept
5. Create rule to permit traffic for following TCP services: SSH and NETCONF (to allow
management of MCR):
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 3 match protocol tcp dst-port
services [ netconf ssh ]
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 3 actions action accept
NOTE:
The above rule permits SSH or NETCONF connection addressed to the cellular interface’s IP
address. If it is desired that SSH or NETCONF connection only be allowed via the VPN tunnel,
then ipsec match criteria described
below
should be used instead of above rule.
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 3 match ipsec direction in
tunnel-src-address 10.150.1.1/32 tunnel-dst-address 10.150.1.10/32
admin@(none) 19:33:20% set services firewall filter IN_UNTRUSTED rule 3 actions action accept
Above example assumes cell interface’s IP address is 10.150.1.10 and VPN Gateway’s IP address is
10.150.1.1.
