3Com 3CRFW102, Руководство пользователя

Страница: 17 / 38

Firewall PC Card 13
Fragmented Packets --Denies fragmented packets.
IP Options --Denies packets with IP options. These packets are usually used for
network testing and debugging.
In addition to these features, the Firewall PC Card products are also “location
aware”. This allows a security administrator to provide varying levels of security
depending on where the notebook computer is located. A strict policy can be
implemented while the notebook computer is outside of the perimeter firewall,
and a less restrictive one can be in place while the notebook is inside the
perimeter.
Enabling the Firewall Until you enable the firewall functionality of the 3Com Firewall PC Card with
10/100LAN, it will emulate the functions of a standard network interface card.
Enabling the firewall functionality requires the 3Com Embedded Firewall Policy
Server.
The 3Com Embedded Firewall Policy Server allows you to create a cryptographic
binding between the Firewall Client Devices and the Policy Server. This prevents
someone from installing a central management console and taking control of your
Firewall Client Devices.
When you create a customized installation package, the following cryptographic
functions are preformed:
1 When the Policy Server is installed, it generates an RSA 1024 Public/Private keypair.
The public key is written to the Firewall Client Device flash memory.
2 When the Firewall Client Device boots up, it generates a random 3DES session key,
encrypts that key with the policy server’s public key, and then sends that
information to the policy server.
3 The policy server decrypts the message using its private key, and then implements
the random 3DES session key as communicated by the Firewall Client Device.
4 This cryptographic binding adds to the tamper resistance of the 3Com Embedded
Firewall solution. It encrypts the policy distribution traffic between your Policy
Server and the Firewall Client Devices. It also locks down your Firewall Client
devices so they only accept policies from your specific Policy Server (because of the
public/private keypair).
Please see the 3Com Embedded Firewall Policy Server Administration Guide for
more information on creating a customized installation package that will enable
the firewall functionality on your Firewall PC Card and cryptographically bind the
card to your Policy Server.
Important Notes The 3Com Firewall Client provides state-of-the-art network security and is
designed to be tamper resistant. Follow these simple procedures to avoid
inadvertently triggering the tamper-resistance feature. Doing so will prevent a
time-consuming recovery process.