I have a config that I need to pull information out of but have not used NetScreen Firewalls in the past.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
yes
I'm trying to figure out what the ACL/Rules are telling me. Some of them are pretty straight forward but some are not.
Is there a certain order that things will appear in them. like untrusted to trust then services allowed or untrusted and services to trust / services I have a few long rules/acls and trying to figure out what is what.
examples:
set policy id 999 "MES" from 'Untrust" to Trust" "192.168.0.0/24" "168.192.1.128/25" "ANY" tunnel vpn "MES" id 3 pair-policy 998 log
set policy id 999
exit
I'm assuming on this one that this is allowing from a group named MES from the Untrusted side to Trusted side (the IP addresses here have me confused) but the ANY is protocol through a tunnel (not sure on the MES part or pair-policy) that is setup and that they are logging the results.
second line is actually setting the acl/rule in the configuration, and then exiting the command line to create/set rule.
set policy id 999 name "MSA" from "Trust" to "Untrust" "192.168.0.254/32" "168.192.0.0/16" "ANY" permit log
set policy id 999 disable
set policy id 999
set log session-init
exit
I'm assuming on this one that this isallowing a group named MSA from my trusted side to untrusted side from IP address 192.168.0.254/32 to subnet 168.192.0.0/16 with ANY services and thatthey are logging the results.
Not sure of line two
third line is actually setting the acl/rule in the configuration
forth line setting the logging
fith line exiting the command line to create/set rule.
set policy id 999 from "Trust" to "Untrust" "192.168.0.254/32" "ANY" permit log
set policy id 999
set service "HTTPS"
set service "SMTP"
set log session-init
exit
I'm assuming on this one that this is allowing from my trusted side to untrusted side to IP address192.168.0.254/32 with the services of HTTPS and SMTP and that they are logging the results.
second line is actually setting the acl/rule in the configuration
third and fourth line selecting the protocols allowed
fith line setting the logging
six line and then exiting the command line to create/set rule.
Please review these and let me know what I have missed on these ACL's / Rules. i think I will be able to break out all the rest of the config with some of my blanks filled in.
http://rsivanandan.com/Dat
Cheers,
rsivanandan
the order of the policies is important since they are processed in order of appearance. if you put a global deny policy before an allow policy, all traffic will be denied regardless of what you place after the rule. it is easier to visualize the policies if you go into the policy section of the WebUI.
set policy id 999 "MES" from 'Untrust" to Trust" "192.168.0.0/24" "168.192.1.128/25" "ANY" tunnel vpn "MES" id 3 pair-policy 998 log
set policy id 999
exit
set policy id 999,
policy name MES
source untrust zone destination trust zone
source ip 192.168.0.0/24 (looks like te entire 192.168.0.x network)
destination ip 168.192.1.128/25
service Any (so http, rdp, telenet etc ...)
tunnel = means this is a policy based vpn named MES
id pair is corresponding return traffic policy
the source ip is the LAN of the remote network that is connected via the VPN whereas the destination ip looks like the local LAN.
set policy id 999 name "MSA" from "Trust" to "Untrust" "192.168.0.254/32" "168.192.0.0/16" "ANY" permit log
set policy id 999 disable
set policy id 999
set log session-init
exit
policy id 999
policy name MSA
source zone trust
destination zone untrust
source ip 192.168.0.254/32
destination ip 168.192.0.0/16
service Any (all protocols)
permit = allow traffic (other options are deny and reject)
policy is disabled
logging on session initialize (default is log on session close
so as you can see, you pretty much have nailed the basic lingo. looking at the gui while comparing the text based commands helped me alot in the beginging. Ploicy based VPNs add an extra wrinkle to your setup and i prefer to use route based VPNs. The VPN setup may be best left for a new question.
please feel free to add comments or addtional questions if you have any.
sangamc
little confused on the policy being disabled one. if someone went back in a re enabled it would the line set policy id 999 disable go away in this.
Yeah I wish I had the option to use the GUI, I saw online that it looks very straight forward. I'm a security person that has been promoted to a team that goes around and looks at configs for sites and try to understand what they are doing based on configs only.
yes if the policy is enabled the line would disappear for pid 999
when i meant the gui, i wasnt being clear. i actually meant the webui which you login by going to
http://netscreen_gateway/
from any web broswer.
before i had the NSM java gui manager i used the web interface in combination with the cli to help manage the devices. NSM is really only useful if you need to manage more than 50 devices since you can use templates and global settings that can apply across multiple devices and device models :)
Business Accounts
Answer for Membership
by: sangamcPosted on 2009-09-08 at 08:28:40ID: 25282882
from the web interface you can go to configuration>update>config file. from there you can look at the current config, download, or update as well