3Com 3CRFW102, Руководство пользователя

Страница: 18 / 38

Procedure 1
Create and retain a policy server recovery diskette.
After installing your first policy server, it is critical to make a copy of the files
named “public.key” and “server.keystore” from your installation. Save this data
indefinitely in a safe, secure location.
In the unlikely event of a disaster, such as a disk crash on all your policy server
machines and a simultaneous loss of all disk backups for these machines, this
recovery diskette allows you to “clone” your policy server and regain management
control of your network interface cards. A clean installation of the policy server
cannot communicate with your Firewall Client network interface cards (which is
the intended design, for security reasons).
If you do not create a recovery diskette and you lose all policy server installation
data, you will not be able to recover your network interface cards. They will
continue to enforce the fallback mode specified in their last EFW policy,
indefinitely. These network interface cards must be replaced in order to obtain a
different policy.
Procedure 2
If diagnostics are desired, install them before the Firewall Client.
If diagnostics are desired for a network interface card installation, install them first
from the 3Com EtherCD before installing the 3Com Firewall Client. Installing them
over the Firewall Client may make the card inoperable.
Procedure 3
Do not attempt installation of non-firewall firmware over an Firewall PC
Card.
Instruct users and administrators that after installation of the Firewall Client on a
card, installing any non-firewall firmware over this Firewall Client installation may
render the card inoperable. If you wish to install non-firewall firmware on an
Firewall Client network interface card, you must first successfully delete the card
from its Firewall Client domain using the Management console, as noted below.
Procedure 4
Use the correct procedure for removing a card from the Firewall Client
system.
Always delete a network interface card from the 3Com Firewall Client via the
Management Console first, if you intend to remove it from the system and wish to
“uninstall” the firewall client on the card. If this step is not taken, moving a
Firewall Client card to a non-firewall host, or attempting to install non-firewall
firmware over an Firewall Client card, may render it inoperable. The principle here
is that only the firewall administrator may make the decision that a network
interface card should no longer have an embedded firewall; the end user cannot
effectively remove a firewall.