Packet Filter Policies
54
WatchGuard System Manager
SSH
Secure Shell (ssh) is a free application protocol that allows remote login, command control, and the
movement of files between computers. It gives strong authentication and secure (encrypted)
connections. We recommend the use of ssh because it is more secure than more vulnerable protocols
such as telnet, rssh, an
d rl
ogin.
UNIX versions are available from www.ssh.com, and information on versions for Windows can be found
at F-Secure (
http://www.f-secure.com
).
Characteristics
•
Internet Protocol(s): TCP
•
Port Number(s): 22
SSL-VPN
This is the built-in policy template for SSL-VPN.
Characteristics
•
Internet Protocol(s): TCP
•
Port Number(s): 443
SunRPC
Sun Remote Procedure Call (Sun RPC) was developed by Sun Microsystems for connections between
clients and servers in the Sun network file system.
Characteristics
•
Internet Protocol(s): TCP, UDP
•
Port Number(s): TCP 111, UDP 111
Syslog
Syslog is a policy used to record operating system events on UNIX hosts. Syslog data is usually enabled
on a firewall to collect data from a host outside the firewall.
The Syslog port is blocked in the default Firebox configuration. To allow one log host to collect logs
from more than one Firebox:
•
Remove port 514 from the Blocked Ports list
•
Add the WatchGuard® Logging policy to Policy Manager
Characteristics
•
Internet Protocol(s): UDP
•
Port Number(s): 514
It is usually not secure to allow syslog traffic through the Firebox. It is possible for hackers to fill
syslogs with log entries. If the syslog is full, it is more difficult to see an attack. Also, the disk
frequently fills up and the attack is not recorded.
