40
VM-Series
Deployment
Guide
Secure East-West Traffic with the VM-Series Firewall
Set Up a VM-Series Firewall on the Citrix SDX Server
based on protocol, to the internal server IP address 172.16.10.20. The return traffic from 172.168.10.20 is
then sent to the NetScaler VPX at 172.168.10.3, and the source IP address for the request is set as
172.168.10.3 and is routed to the VM-Series firewall at 172.168.10.2. On the VM-Series firewall, a policy
lookup is again performed and the traffic is routed to the server in the DMZ (192.168.10.10).
.
In order to filter and report on user activity on your network, because all requests are initiated from the
NetScaler VPX, you must enable
HTTP Header insertion
or the
TCP Option for IP Insertion
on the first
instance of the NetScaler VPX.
Set up the VM-Series Firewall to Secure East-West Traffic
Step 1
Install the VM-Series Firewall
If you plan to deploy the VM-Series firewall using virtual wire or L2
interfaces, make sure to enable L2 Mode on each data interface on
the SDX server.
Step 2
Re-cable the interfaces assigned to the
NetScaler VPX.
Because the NetScaler VPX will reboot
when recabled, evaluate whether you
would like to perform this task during a
maintenance window.
Step 3
Configure the data interfaces.
1.
Select
Network > Interfaces
and assign the interfaces as type
Layer3 (see
Step 2
, Layer2 (see
Step 3
) or virtual wire (see
Step 3
).
Step 4
Create security policy to allow application
traffic between the DMZ and the
corporate data center.
Zone: DMZ to Corporate
Note that the implicit deny rule will deny
all inter-zone traffic except what is
explicitly allowed by security policy.
1.
Click
Add
in
the
Policies > Security
section.
2.
Give the rule a descriptive name in the
General
tab.
3.
In the
Source
tab, set the
Source Zone
to DMZ and
Source
Address
to 192.168.10.0/24.
4.
In the
Destination
tab, set the
Destination Zone
to Corporate
and the
Destination Address
to 172.168.10.0/24
5.
In the
Application
tab, select the applications that you want to
allow. For example, Oracle.
6.
Set the
Service
to
application-default
7.
In the
Actions
tab, set the
Action Setting
to Allow.
8.
Leave all the other options at the default values.
9.
Click
Commit
to save your changes.
