Nortel SMC 2450, Руководство по внедрению

Страница: 108 / 262

Page 108 of 260 Firewall deployment
553-3001-225 Standard 1.00 May 2006
You can troubleshoot the firewall policies by first determining what traffic is
denied and then adding an appropriate policy for the relevant SMZ.
Figure 18 shows HTTPS and UNIStim traffic flowing correctly through the
SMC. Note that the RPC traffic is blocked by the firewall because a rule for
the RPC protocol is not included in the default TLAN rule set.
Figure 18
HTTPS and UNIStim traffic flow
Use the following methods to troubleshoot firewall problems:
Allowing ping
If the end-to-end connectivity between the client and the server is in question,
it is helpful to allow ping to pass through the SMC so the client can validate
that packets are correctly routed to and from the server.
By default, ping is not allowed through the firewall for security reasons. To
allow ICMP packets to flow through the SMC and thereby enable ping, add
an inbound rule to the appropriate Security Zone and choose ICMP as a
custom service. The Security Zone should be the one in which the accessed
server is located.