Body
Audience
Staff
Overview
This document will describe the specific actions & parts for submitting a firewall request.
Type Of Rule
Firewall requests submitted to Pitt are broken into two areas:
SERVER TO SERVER RULES
- The first area that firewall rules are configured are by server to server communications. This is for the normal operations of our applications (i.e. the front-end talks to the back-end). These rules are set once and almost never need to be modified in the future. By design this is how servers communicate via IPv4 addresses. Below are the areas required to configure a server to server rules.
- Select the appropriate VLAN where the "destination" server(s) lives (this is based on the IP address of the server). In most cases there are only two VLAN/Zone where our servers reside
- DMZ Zone Name: LP-SOM-SVCHIT-D - IP Range: 10.227.1.1/24
- Secure Zone Name: LP-SOM-SVCHIT-S - IP Range: 10.226.1.1/25
- Source - This is the source device(s) that requires access to the server. This can be shown in a couple different ways:
- Individual server - This would be shown by the servers FQDN i.e. server.hs.pitt.edu
- Network Object Group (NOG) - This is a group of systems based upon the same use case such as SVCHS-PROD-WEB-SQL-SVR.
- Entire VLAN/Zone - This contains the entire IP range of a particular VLAN/Zone such as LP-SCHOOL-OF-MED-DMZ-I
- Destination - This is the destination device(s). This can be shown in a couple different ways:
- Individual server - This would be shown by the servers FQDN i.e. sqlservername.hs.pitt.edu
- Network Object Group (NOG) - This is a group of systems based upon the same use case such as SVCHS-PROD-SQL-SVR.
- Services - This is the services/ports on which the server is allowed to communicate. This can be shown in a couple different ways:
- Pre-defined Services - There are a couple predefined services provided
- Windows Remote Desktop
- SSH
- Windows File Sharing
- Web services
- PING
- Printing
- SNMP
- Service Object Group (SOG) - This is a group of systems based upon the same use case such as SVCHS-MSSQL-PORTS.
- Ports - Specific ports used for the purpose. The ports can be in three protocols/categories and add the port number on which it runs
- TCP - 80, 443, etc...
- UDP - 53, 161, etc...
- TCP/UDP - 1433, 1434, etc...
IDENTITY BASED TO SERVER RULES
- The second area that firewall rules are configured by is Identity Based access to server communications. This is for a group of users. These rules are usually set once and the groups are managed by RC administrators. The Palo Identity based design provides access based upon the user credentials instead of IPv4 addresses. This provides the user the ability to login with Pitt credentials anywhere using the Global Protect Client and access the exact same resources as if he/she were at their desk. Below are the areas required to configure a Identity based to server rules.
- Select the appropriate VLAN where the "destination" server(s) lives (this is based on the IP address of the server). In most cases there are only two VLAN/Zone where our servers reside
- DMZ Zone Name: LP-SOM-SVCHIT-D - IP Range: 10.227.1.1/24
- Secure Zone Name: LP-SOM-SVCHIT-S - IP Range: 10.226.1.1/25
- Source - This is the source RC Group(s) that requires access to the server(s). This can be shown in a couple different ways:
- RC/CDS Group - This would be shown by SVCHS-FW-NETWORK-ADMINS, SVCHS-FW-SVC-DEVELOPERS, SVCHS-FW-INSITE-CONSULTANTS, etc...
- Destination - This is the destination device(s). This can be shown in a couple different ways:
- Individual server - This would be shown by the servers FQDN i.e. sqlservername.hs.pitt.edu
- Network Object Group (NOG) - This is a group of systems based upon the same use case such as SVCHS-PROD-SQL-SVR.
- Entire VLAN/Zone - This contains the entire IP range of a particular VLAN/Zone such as HE-SOM-SVCHIT-SENS-W, LP-SOM-SVCHIT-S, etc...
- Services - This is the services/ports on which the server is allowed to communicate. This can be shown in a couple different ways:
- Pre-defined Services - There are a couple predefined services provided
- Windows Remote Desktop
- SSH
- Windows File Sharing
- Web services
- PING
- Printing
- SNMP
- Service Object Group (SOG) - This is a group of systems based upon the same use case such as SVCHS-MSSQL-PORTS.
- Ports - Specific ports used for the purpose. The ports can be in three protocols/categories and add the port number on which it runs
- TCP - 80, 443, etc...
- UDP - 53, 161, etc...
- TCP/UDP - 1433, 1434, etc...
DESCRIPTION/REASON
The description/reason for the firewall rule is very important. In the past we have used the same wording for each rule because it was generic. This unknowingly has caused issue for the firewall managers. Most rule sets are very similar in design and the description/reason is what Pitt uses to differentiate a specific rule from others. It is required that we be as descriptive as we can to assist in the management of our rules. There are three parts of the description area shown below.
Starting Point / Environmental Context
- Allow/Deny - By default this is allowing or denying the rule within the firewall.
- We leave the default ALLOW
- Description - Summarizing the rule reason is best for management. Below are some examples
- User remote access for their desktops
- User file chase access to their desktops
- User access to print at office
- User ability to PING their desktops
- Developer access to production SQL Servers
- Developer access to test/dev application servers
- Sensitive Data - This is almost always a NO in our situation.
After you click the Add button you will be given a summary of what you are trying to submit. After you have verified that all is correct click the submit button and your ticket will be created as well as send you an automated E-mail notification with your ticket number. You can follow or verify that your rule is completed once you receive an E-mail notifying of the completed ticket. Then log in to the firewll.pitt.edu site and check to see if the rule is showing. It can take a day or two to show.