VCS Expressway Firewall Help

[Timothy Shire]

I am Trying to comunicate the needs of the VCSe sitting in a DMZ With NIC1 - Internal 10.10.10.10 for managment and NIC2 - External NATed 192.168.200.200 NATed to Public IP.

I have came up with the attached spreadsheet.

Can anyone please review and see if there are any big mistakes or things that you would change.

Thanks in Advance.

Tim

[Martin Koch]

did not check on your file, two short remarks

* this deployment requires the dual interface option (which I would assume you have)

* the vcs nicely displays you the used ports under https:///localportlist and https:///sourceportlist

[Timothy Shire]

Thanks for that, the File is using the Port usage details.

I am just looking to find the cleanest and clearest way to communicate this info to a firewall admin.

Thanks for the Responce, Please look at the files and provide some more feedback.

Tim

[Martin Koch]

I am not sure if I have the time to look at it, as it can be quite time consuming :-)

Anyhow, if you need a very locked down setup, some more info about the deployment

would be needed, best a would be a drawing.

Like where are endpoints located, where is the TMS, is there a VCS-C, is the TMS Agent,

who shall access the management ports and from where, ...

From what I saw on a first short look there are some not needed ports open and some which I would close.

[Timothy Shire]

Great feedback,

I will add a sample drawing to the file and also define the location of the other products.  I won't get to it today but i want this to be a referance tool that i can change any update for each client.

Thanks again for the feeback

Tim

[Alok Jaiswal]

Hi Timothy,

I just checked the file..i have a question..since the traversal setup is between the vcs control and Nic 1 on expressway then why you are opening the ports for NIC 2 as well from LAN to DMZ????

if that would have been the case then you would have simply used a single NIC why both the NIC?

Also i want to know what do you mean by LAN->DMZ<-->internet ??? because on the port 6001 and 7001 you mentioned this..DMZ to internet this ports are not required!!

Also you didn't mentioned the port 5061 from internet to DMZ in the file??open the 5060 TCP port from internet to DMZ as well.

i am still going through the file..if i find anything more i will let you know..

Thanks

Alok