HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
HP-UX IPFilter and Serviceguard
Using HP-UX IPFilter with Serviceguard
Chapter 10 143
Serviceguard Manager If you are using the station-management
version of Serviceguard Manager, you must configure rules to let SNMP
traffic pass between all nodes in the cluster and the Serviceguard
Manager node.
Each cluster node must have the following rules configured:
pass in quick proto udp from
<SGMgr node>
to
<clusternodes>
port = 161 keep state
pass out quick proto udp from
<clusternodes>
to
<SGMgr node>
port = 162 keep state
Each Serviceguard Manager node must have the following rules
configured:
pass out quick proto udp from
<SGMgr node>
to
<clusternodes>
port = 161 keep state
pass in quick proto udp from
<clusternodes>
to
<SGMgr node>
port = 162 keep state
In the previous set of rules,
<clusternodes>
are all nodes in the cluster,
including the local node, and
<SGMgr node>
is the node or nodes running
Serviceguard Manager.
NOTE The previous sections are examples and meant to serve as guidelines.
You might need to modify them to work with your network configuration
and the applications you use. Specific applications used within the
Serviceguard cluster might require additional ports to be opened.
DCA Remote Failover
Normally, IPFilter keep state rules are configured with the flags S
parameter. This parameter instructs IPFilter to create a TCP state entry
only when a SYN packet is parsed.
To enable transparent failover between IPFilter DCA nodes, do not use
flags S with keep limit rules. If incoming TCP/IP traffic is switched
from the active to the standby node, DCA can rebuild the previous
IPFilter state table and IPFilter DCA limit tables from the data stream.
Without flags S in the keep limit rule, IPFilter creates a new state