Clavister NetWall 6000 Series, Руководство по началу работы, Страница: 70 / 99

By default, only cOS Core's internal memlog feature will capture generated log messages. To send
logs to an external Syslog server, a log receiver object must be configured. For example, the
following command will send logs to a Syslog server at the IP address
192.0.2.10 :
Device:/> add LogReceiverSyslog my_syslog IPAddress=192.0.2.10
Allowing ICMP Ping Requests
As a further example of setting up IP policies, it can be useful to allow ICMP ping messages to
flow through the firewall. As discussed earlier, cOS Core will drop any traffic unless an IP rule set
entry explicitly allows it. Suppose that we wish to allow the pinging of external hosts by hosts
located on the protected network
G1_net . The command to define an IP policy called
allow_ping_outbound to allow this traffic would be the following:
Device:/> add IPPolicy Name=allow_ping_outbound
SourceInterface=G1
SourceNetwork=InterfaceAddresses/G1_net
DestinationInterface=G2
DestinationNetwork=all-nets
Service=ping-outbound
Action=Allow
SourceAddressTranslation=NAT
NATSourceAddressAction=OutgoingInterfaceIP
The IP policy above assumes NAT will be used and this is necessary if the protected local hosts
have private IPv4 addresses. The ICMP requests will be sent out to the Internet with the IP
address of the firewall interface connected to the ISP. Responding hosts will send back ICMP
responses to this single IP and cOS Core will then forward the traffic to the correct private IP
address.
Adding a "Drop All" Policy is Recommended
Scanning of IP rule sets is done in a top-down fashion. If no matching rule set entry is found for
traffic then a hidden, implicit default rule is triggered. This rule cannot be changed and its action
is to drop all such traffic as well as generate a log message when it is triggered.
In order to gain more control over dropped traffic and its logging, it is recommended to create
an explicit "drop all" IP policy as the
last entry in the main IP rule set. This policy has both the
source and destination network set to all-nets and both the source and destination interface set
to any . The service would be set to all_services in order to trigger on all traffic types.
The following command defines an explicit "drop all" policy with logging disabled:
Device:/> add IPPolicy Name=drop_all
SourceInterface=any
SourceNetwork=any
DestinationInterface=any
DestinationNetwork=all-nets
Service=all_services
Action=Deny
LogEnabled=No
A Valid License Should Be Installed
Lastly, a valid license should be installed to remove the cOS Core 2 hour demo mode limitation.
Without a license installed, cOS Core will have full functionality during the 2 hour period
following startup, but after that, only management access will be possible. Installing a license is
described in
Section 4.4, “License Installation” .
Chapter 4: cOS Core Configuration
70