Siemens RUGGEDCOM ROX II, User Manual

Page: 233 / 798

RUGGEDCOM ROX II
CLI User Guide
Chapter 6
Security
Adding a Firewall 187
If no firewalls have been configured, add firewalls as needed. For more information, refer to Section 6.9.3,
“Adding a Firewall” .
Section 6.9.3
Adding a Firewall
To add a new firewall, do the following:
1. Make sure the CLI is in Configuration mode.
2. Add the firewall by typing:
security firewall fwconfig
firewall
Where:
•
firewall
is the name of the firewall
3. Configure the following parameter(s) as required:
Parameter Description
description { description } Synopsis: A string
An optional description string.
4. Add interfaces associated with the firewall. For more information about adding interfaces, refer to
Section 6.9.10.2, “Adding an Interface” .
5. Add network zones for the firewall. Make sure a zone with the type firewall exists. For more information
about adding network zones, refer to Section 6.9.9.2, “Adding a Zone” .
6. Associate an interface with each zone. For more information about associating interfaces with zones, refer to
Section 6.9.10.3, “Associating an Interface with a Zone” .
7. Set the default policies for traffic control between zones. Make sure the policies are as restrictive as possible.
For more information about configuring policies, refer to Section 6.9.12, “Managing Policies” .
8. Configure the network address translation (NAT), masquerading or static network address translation (SNAT)
settings. For more information about configuring NAT settings, refer to Section 6.9.13, “Managing Network
Address Translation Settings” . For more information about configuring masquerading and/or SNAT settings,
refer to Section 6.9.14, “Managing Masquerade and SNAT Settings” .
9. If hosts on the network must accept sessions from the Internet, configure the firewall to support Destination
Network Address Translation (DNAT). For more information about configuring hosts, refer to Section 6.9.11,
“Managing Hosts” .
10. If required, configure rules that override the default policies. For more information about configuring rules,
refer to Section 6.9.15, “Managing Rules” .
11. If required, configure support for a VPN. For more information, refer to:
• Section 6.9.6, “Configuring the Firewall for a VPN”
• Section 6.9.7, “Configuring the Firewall for a VPN in a DMZ”
12. Validate the configuration. For more information about validating a firewall configuration, refer to
Section 6.9.16, “Validating a Firewall Configuration” .
13. Enable the firewall. For more information, refer to Section 6.9.17, “Enabling/Disabling a Firewall” .
14. Type commit and press Enter to save the changes, or type revert and press Enter to abort.