3
Managing EFW Devices Using the Policy Servers
42
Monitoring NIC Connectivity and Policy Status
You can use the Status button to check the connectivity and policy status of a single NIC.
Clicking the Status button sends a status request to the selected NIC. The result is a NIC
Status window that indicates whether the NIC is responding, and whether it is running
the policy that is currently in the database.
Since any computer secured by EFW can be offline at any time, a status of not responding or
a missed heartbeat does not necessarily indicate a problem For example, a NIC in a low
power mode, such as standby, is shown as not responding. EFW devices are not typically
monitored on an individual basis. If a secured computer reports a networking problem, or
if a secured computer is traced as the source of unusual activity, you could check the status
using the Status button to determine whether or not the EFW device was functioning
as expected.
The NIC Status Window provides the following information:
■
Name: User-definable name for the NIC
■
Responding: Yes or No (“No” may simply mean the system is turned off.)
■
Enforcement: Indicates whether the Policy Enforcement option is turned off or on
(see page 10 for details)
■
Block All Traffic: Indicates whether the Block All Traffic option is turned off or on
(see page 56 for details)
■
Policy: Name of the policy being enforced
■
Policy is up-to-date: Yes, No, or Unknown (indicates the managing Policy Server is
unavailable)
Maintaining EFW NICs
A key characteristic of EFW is that it is hardware-based and is designed to be tamper-
resistant. This characteristic gives the advantage of there being no way from the secured
computer's operating system to disable the NIC's enforcement capability.
Follow the few simple procedures described in this section to avoid inadvertently
triggering the tamper-resistance feature. Doing so will prevent a time-consuming
recovery process.
■
Create and retain a policy server diskette.
If you have not already done so, create a recovery diskette that contains the files
named “public.key” and “server.keystore” from your installation. Save this data
indefinitely in a safe, secure location. See “Creating a Recovery Diskette” on page 29
for details.
The recovery process using this diskette is described on “Using the Recovery Diskette”
on page 44.
■
If NIC diagnostics are desired, install them before EFW.
If diagnostics are desired for a NIC installation, install them first from the
3Com EtherCD
before installing EFW. Installing NIC diagnostics over EFW may make
the card inoperable.
NOTE:
If the policy is not up-to-date or not running the policy you expect, you can
click the Distribute Policy button to immediately send the policy and option settings
(turn off Enforcement or Block All Traffic) to the NIC.
NOTE:
If you have diagnostics installed on the NIC before you install EFW, you
retain the diagnostics capability after the EFW installation.
