32
VM-Series
Deployment
Guide
Secure North-South Traffic with the VM-Series Firewall
Set Up a VM-Series Firewall on the Citrix SDX Server
8.
(Optional) To enable you to ping or SSH in to the interface,
select
Advanced > Other Info
, expand the
Management Profile
drop-down, and select
New Management Profile
. Enter a
Name
for the profile, select
Ping
and
SSH
and then click
OK
.
9.
To save the interface configuration, click
OK
.
10.
Click
Commit
to save your changes to the firewall.
Step 3
Create a basic policy to allow traffic
between the NetScaler VPX and the web
servers.
In this example, because we have set up
only one data interface, we specify the
source and destination IP address to allow
traffic between the NetScaler VPX and
the servers.
1.
Select
Policies > Security,
and click
Add
.
2.
Give the rule a descriptive name in the
General
tab.
3.
In the
Source
tab, select
Add
in the Source Address section and
select the New
Address
link.
4.
Create a new address object that specifies the SNIP on the
NetScaler VPX. In this example, this IP address is the source for
all requests to the servers.
5.
In the
Destination
tab, select
Add
in the Destination Address
section and select the New
Address
link.
6.
Create a new address object that specifies the subnet of the web
servers. In this example, this subnet hosts all the web servers
that service the requests.
7.
In the
Application
tab, select web-browsing.
8.
In the
Actions
tab, complete these tasks:
a.
Set the
Action Setting
to
Allow
.
b.
Attach the default profiles for antivirus, anti-spyware, and
vulnerability protection, under
Profile Setting
.
9.
Verify that logging is enabled at the end of a session under
Options
. Only traffic that matches a security rule will be logged.
10.
Create another rule to deny all other traffic from any source and
any destination IP address on the network.
Because all intra-zone traffic is allowed by default, in order to
deny traffic other that web-browsing, you must create a deny
rule that explicitly blocks all other traffic.
Set up the VM-Series Firewall to Process North-South Traffic Using L3 interfaces (Continued)
