PARAMETER
DEFINITION
Interface
This is the interface where traffic will be inspected for traffic pattern matching and also the interface where the NAT will be
performed.
Source
The source host/network listed here is inspected for traffic pattern matching.
Destination
The destination host/network listed here is inspected for traffic pattern matching.
Service
The service listed here is inspected for traffic pattern matching.
Action
The action to be performed on the traffic that matches the pattern for this rule.
Connection
Status
This rule will apply to traffic matching the chosen connection status type.
- Not needed: The traffic is associated with no known connection.
- New: The traffic has started a new connection or otherwise associated with a connection which has not seen packets in both
directions.
- Established: The traffic is associated with a connection which has seen packets in both directions.
- Related: The traffic is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an
ICMP error.
Rule State
Defines whether the rule state is active or not.
To add a Firewall Policy:
1.
From the sidebar, click
Firewall and NAT
, then click the
Policy
tab.
2.
In the Firewall Setup Section, under the Add a Firewall Policy heading, use the drop-down menu to select Input,
Output or Forward under Direction.
3.
Enter valid names for the following: Order, Interface, Source, Destination and Service.
NOTE: Valid names must be between 3 and 40 alphanumeric characters.
4. Use the drop-down menus to select the Action, Connection Status and Rule State.
5.
Click
Apply
.
For each rule, an action (either
ACCEPT
,
DROP
,
REJECT
or
LOG
) must be selected from the Policy drop-down menu. The
selected action is performed on an IP packet that matches all the criteria specified in the rule.
If
LOG
is selected from the drop-down menu, it will create entries in syslog about the traffic matching this rule without
performing a specific ACCEPT, REJECT or DROP action. In order to log and ACCEPT or log and REJECT/DROP a second
rule must follow the log rule with the same traffic pattern and the desired ACCEPT, REJECT, DROP action. The
administrator can configure a log level, a log prefix and whether the TCP sequence, TCP options and IP options are logged
in the Log Options Section.
If
REJECT
is selected from the drop-down menu, an administrator can select an option from the Reject with pull-down menu;
the packet is dropped and a reply packet of the selected type is sent.
To modify or delete a Firewall Policy:
1.
From the sidebar, click
Firewall and NAT
, then click the
Policy
Tab.
2.
Under the User Defined Firewall Policies heading, check the box next to the policy you want to edit or delete.
3.
Make your changes and click
Apply
.
-or-
Click
Delete
to delete the policy.
6.5.6 1-to-1 NAT
The 1-to-1 NAT wizard allows an administrator to create an external access point for a service processor (SP) that is
connected to a private network via the appliance. The wizard follows a simple step-by-step process that, at its completion,
assigns both managed and currently unmanaged SPs a public external IP address in order to mask a private internal IP
address. A time-saving component of this process incorporates the discovery of unmanaged SPs while also assigning the
parameters of a NAT policy rule without leaving the wizard. After the unmanaged SP is added to the appliance, the wizard
guides an administrator through configuring the target with an external IP address.
Vertiv
| Avocent® Universal Management Gateway Appliance Installer/User Guide |
83
