Firewalls

This section includes the following topics:

• Firewall types

• Creating a firewall

• Modifying firewall properties

• Removing a firewall

• Monitoring firewall status

Each Firewall node in the Security Editor represents an installed Amaranten Firewall unit, which can be either a product from the Amaranten Firewall Appliance series, or from the Amaranten Firewall Software series. Representing the actual firewall installations, firewall nodes are naturally the most important nodes available in the Security Editor.

The screen shot to the right illustrates a sample firewall, named Paris. The firewall node is illustrated with a server-like icon. Depending on the status of the firewall, the icon can have an overlay image representing an information, warning or error status. For more information about firewall status, please see the section Monitoring firewall status below.

Each firewall node contains a number of child nodes, mainly folders, each containing the various configuration sections of the firewall:

• Rules ?contains the rule-set, which is the main filtering table of the firewall.

• Routing ?contains all configuration sections needed to configure IP routing in the firewall. This includes normal static routing as well as Policy-Based routing and DHCP Relay. Please see section Routing for more information about the individual routing configuration sections.

• Interfaces ?contains interface related configuration sections. For instance, Ethernet adapters, Virtual LANs and VPN tunnels are configured in sections residing in this folder. Please see section Interfaces for more information about interface related configuration.

• Local Objects ?contains configuration sections identical to the ones defined in Namespaces. These include, for instance, Hosts & Networks, Services and VPN Settings. When defining a configuration item in Local Objects, the item will be available to the local firewall only, as opposed to defining the item in a Namespace, where it will be available to all underlying firewalls.

• Miscellaneous ?contains the configuration sections Access, Remotes and Pipes. The Access section provides anti-spoofing capabilities. The Remotes section configures remote management and the Pipes section is used for Traffic Shaping functionality. Please see the corresponding sections for more information.

• Advanced Settings ?contains parameter settings for the firewall. These include protocol time-outs, header lengths, IP options, TCP flags etc. Please see section Advanced Settings for more information.

All the configuration sections together build up the entire firewall configuration, which is used run-time by the actual Amaranten Firewall.

Firewall types

The Security Editor defines three types of firewalls, namely:

• Appliance ?represents a firewall from the Amaranten Firewall Appliance series of products. When installing an appliance firewall, major parts of the configuration, for instance, interfaces, routing and so forth, are auto-generated.

• Software ?represents a firewall from the Amaranten Firewall Software series of products. A software firewall is similar to an appliance, but with one major difference; a software firewall involves creating and managing boot medias, which, for obvious reasons, is not needed for appliances.

• Custom ?a custom firewall is used when no auto-generation of configuration is needed. A custom firewall is basically a firewall node with an, initially, empty configuration. The custom firewall type is only recommended to use by experienced users.

There is also one additional pseudo-type of firewall: the High Availability cluster, which is actually several firewalls working as one. For more information about High Availability clusters and firewalls, please see the section High Availability.

The type of the firewall is only important in the creation process. In operation, all firewall nodes look and behave the same in the security editor. The only restriction is for appliance firewall nodes, on which boot media operations are not permitted.

Creating a firewall

To create a new namespace, locate and select the Firewalls node in the namespace where the new firewall is to be created. Right-click the selected Firewalls node and choose Firewall... in the New submenu. The New Firewall Wizard dialog box will be displayed. The process of creating a new firewall is described in detail in the Getting Started guide, especially in the Running the New Firewall wizard section.

Modifying firewall properties

A firewall node contains, except for the firewall run-time configuration, a number of properties used to describe the firewall node, for instance the name of the firewall and how Amaranten Firewall Manager should communicate with it.

To modify the properties of a firewall, first check out the actual firewall, then right-click the firewall and choose Properties... from the context menu. A dialog box similar to the one to the right is shown.

Please note that changing settings in the properties dialog box will not make any changes to the firewall itself. Changing the IP Address in this dialog box, for example, will only change the IP address stored in the management database and used for management communication with the firewall.

General

Options

Click OK to save the properties and to close the dialog box. Finish by checking in the firewall.

Removing a firewall

To remove a firewall, right-click the actual firewall, choose Delete from the context menu and answer Yes to the confirmation question.

Note: Removing a firewall is an irreversible operation.

Monitoring firewall status

Each firewall has a status, representing the health of the firewall. The status is used to indicate, for instance, configuration related errors or problems on a running firewall. The icons of the firewalls in the tree view of the Security Editor will change shape according to their status, and the Status column in the firewall list, shown below, will present the status in clear-text.

An example of a status is Configuration error, which indicates that the corresponding firewall has a severe problem with its configuration. Not all statuses are severe. For instance, the status Needs deployment is not a critical status at all. For this reason, each status is assigned a status level. There are four status levels: Error, Warning, Information, and Ok, in order of importance.

A firewall can have several simultaneous statuses, but only the status with the most important status level will be shown. A status indicating that the firewall is unreachable, for instance, will have precedence over the Needs deployment status.

Amaranten Firewall Manager uses the NetCon remote management protocol to periodically query active firewalls for information. In this way, Amaranten Firewall Manager is able to detect if a firewall is reachable or not. Furthermore, the information returned from the firewall contains important information, for instance the version of the running configuration, the firewall core version and capabilities, firewall uptime etc.

The table below lists all possible statuses, their meaning and what actions that are proposed in order to solve the potential problem.