Personal aXsGUARD - 7.7.1
Chapter 4. Server-Side Configuration
© VASCO Data Security 2013
19
“Security Recommendations”
). Use the Add Policy button to select a firewall policy. The difference between
regular and Tunnel Firewall Policies is explained in the table below.
Figure 4.6. PAX Firewall Configuration
Firewall Policy
Description
Firewall Policies
Firewall rights which define access outside the VPN Tunnel, i.e. to the
Internet or other networks that are not routed via the Tunnel.
Tunnel Firewall Policies
Firewall rights which define access to networks that are only accessible via
the Tunnel.
Table 4.6. Firewall Settings Tab
For a list of available pre-configured Firewall Policies, see the aXsGUARD Gatekeeper Firewall How To, which
can be accessed via the Documentation button in the Administrator Tool.
For the PAX, only the following Firewall Policies can be selected / configured:
• Outside Tunnel Firewall Policies: only
fwd-dynamic
policies (i.e. dynamic policies containing rules of
the type "through the aXsGUARD Gatekeeper" are valid. These policies define access to services on the
Internet when the VPN tunnel is down.
• Tunnel Firewall Policies: only
fwd-dynamic
policies and
sec-dynamic
policies can be selected. The
fwd-
policies define access through the corporate aXsGUARD Gatekeeper towards its secure LAN, its
DMZ zone and optionally the Internet. The
sec-dynamic
policies allow access to services running on the
corporate aXsGUARD Gatekeeper.
Firewall rights can be restricted to a specific IP address or a range of IP addresses by entering them in the
Source IP field. (Use the CIDR notation to specify a range, e.g.
10.0.0.0/24
). Additionally, an IP address
can be assigned to a specific client PC in the secure LAN of the PAX, based on its MAC address and the
PAX’s DHCP server settings (see
Section 4.7, “DHCP Settings”
).
• Any Dynamic Firewall Policy that is not mentioned above, is not suitable to configure the PAX.
• Incoming and outgoing network devices specified in the
fwd-dynamic
do not apply to the PAX.
4.10. NAT Traversal
4.10.1. Activating NAT
NAT must be enabled before you can configure it by checking "Activate NAT" as shown below.
