User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
163
4.6.3.1 Packet Filtering on Ingress and Egress
CAUTION: A use-
ful tool for under-
standing the effect of
configured filters is to
write out the set of rules
as if each rule were 2
rules: one applying to
the inbound packets on
the interface and the
other to the outbound
packets. For example:
add pktfilter -name
SrvTalksToAnyone -
action permit -log N
-type ipv4 -inter-
face lan3 -priority
5 -srcaddr 10.1.1.1
-srcpl 32 -destaddr
0.0.0.0 -destpl 0
This will match all pack-
ets the server 10.1.1.1 on
lan3 sends to any desti-
nation on any interface.
After we exchange all
the source fields for all
the destination fields,
we see that it will also
match all packets being
forwarded from any
source to the server
OUT on lan3.
When a packet enters any interface, the FMP checks whether
packet filtering is enabled on that interface. If it is, the FMP
compares the packet's information to each configured rule in
priority order. The FMP takes the action specified by the first
matching rule; e.g. if the action is permit, the FMP continues to
process the packet. If the action is deny, the FMP drops the
packet immediately. If the packet does not match any of the
configured rules, it will always match the automatically-
generated packet deny rule at the end.
Once the FMP has determined the interface out which the
packet should be forwarded, the FMP checks whether packet
filtering is enabled on that egress interface. If it is, the FMP
compares the packet's information to each configured rule in
priority order - but with one significant difference. The packet's
SOURCE information (address, prefix length, port) is
compared to the rule's DESTINATION information.
4.6.3.2 ICMPv6 Neighbor Discovery Alert
Neighbor Discovery (ND) is IPv6's equivalent of IPv4's ARP
protocol. IPv4 hosts use ARP to discover the MAC address
corresponding to a given IPv4 address. IPv6 hosts use ND to
discover the MAC address corresponding to a given IPv6
address. There is one significant difference when it comes to
packet filtering. ARP is a separate protocol, and is thus not
filtered out by IPv4 filtering mechanisms. ND packets are IPv6
packets, because ND is part of ICMPv6. A user can permit
traffic between two IPv4 hosts with one or two simple IPv4
packet filtering permit rules. For IPv6, however, Fortress
advises permitting all ICMPv6 packets using some variation of
the following rule on all appropriate interfaces:
# add pktfilter -name AllowICMPv6 -action permit -log N -type ipv6 -
interface lan3 -priority 3 -srcaddr 0::0 -srcpl 0 -destaddr 0::0 -
destpl 0 -protocol 58
You must be logged on to an administrator-level account to
change configuration settings (refer to Section 2.2).
4.6.4 Fortress Controller Access Control
NOTE: Local con-
troller authentica-
tion settings apply
regardless of whether
device authentication is
enabled (as described
for Secure Client
devices authentication
in Section 4.5.4, above).
Fortress’s controller device authentication assigns every Mesh
Point a unique Device ID that is subsequently used to
authenticate the device for access to the Fortress-secured
network.
The Mesh Point automatically detects other Fortress devices
on the network and populates a record of authenticating
controllers.
Attempts made by auto-populating devices to connect to the
Mesh Point-protected network are treated according to the