Manage Firewall Requests

Transcription

1 Technology Help Desk HELP [4357] technology.pitt.edu Manage Firewall Requests Overview This document explains how to use firewall.pitt.edu to manage firewall rules requests. Authenticated users can submit firewall change requests for networks for which they are authorized, view the firewall rules for the zones they re responsible for, and manage firewall rules by creating and editing object groups. View Firewall Zone Information 1. Log in to firewall.pitt.edu. Note: If you are already logged in, click the My Zones link located in the Menu on the right-hand side. 2. The firewall zones that you currently have access to are displayed by zone name. 3. Click on a zone Name (in the left table column) to see the specifics for a zone, including Outbound and Inbound Firewall rules. View Firewall Rules and Submit Requests to Delete Firewall Rules 1. Log in to firewall.pitt.edu 2. Click on a Zone from the My Zone list. Note: You will be able to make selections based upon what zones you are authorized to see. 3. The following information will be displayed for the selected zone: Name IP Range Core Context Notes - These can be saved to a zone to help identify Zone Firewall Rules. You can add a very brief note here to identify the rule, then click Save. All those who have access to that zone can see and edit these. Outbound Firewall Rules Inbound Firewall Rules Note: You can use the Filter to search for a match by Name or IP range. Below the zone information, you can see the rules associated with the firewall zone. Outbound Firewall rules are listed first, then Inbound ones. You can click on the Expand symbol ( + sign) for a Source or Destination to get more information about an IP address range. File: Manage Firewall Requests Page 1 of 7 Revised:

2 You can click on the Expand symbol ( + sign) of a Service to get additional information including protocol or port number. The Description column contains any Notes that have been added about the Firewall rule. 4. To submit a delete request, click delete in the right-hand column of one of the Firewall rules to submit that rule for deletion. You will be asked to confirm your decision. Note: When your deletion request is submitted it creates a Remedy ticket. Create a Firewall Rule Request 1. Log in to firewall.pitt.edu. 2. Select Zone Firewall Rules from the menu on the right-hand menu. File: Manage Firewall Requests Page 2 of 7 Revised:

3 3. Select a Zone from the drop-down list. 4. Information will be displayed about that zone including: Name IP Range Core Context Notes Outbound Firewall Rules Inbound Firewall Rules 5. Click either the Add Outbound Firewall Rules or Add Inbound Firewall Rules link. Each link is located above the corresponding table of firewall rules on the right-hand side. 6. Click the Add New [Outbound/Inbound] Firewall Rule link found on the left-hand side of the Request New Firewall Rules page. 7. A Firewall Rule window appears. You will build a source list, a destination list, and a services list. File: Manage Firewall Requests Page 3 of 7 Revised:

4 8. Create the rule request by providing information for each item: For Source: i. Select an Object Group Name from the drop down list or enter one of the following: an IP Address a CIDR (range of IP addresses) a DNS Name. ii. iii. Click add item. To create a new object group (optional): Check the Make an Object Group with these items box. Enter a Name for it in the text field. Note: New object groups are not ready for immediate use. For Destination: i. Select an Object Group Name from the drop down list or enter one of the following: an IP Address a CIDR a DNS Name. ii. iii. Click add item. To create a new object group (optional): Check the Make an Object Group with these items box Enter a Name for it in the text field. Note: New object groups are not ready for immediate use. For Services: i. Select a Pre-Defined Service from the drop down list or select one of the following: A Protocol (TCP, UDP, or TCP/UDP) and a Port number. An Object Group defined on the firewall. ii. iii. Click add item. To create a new object group (optional): Check the Make an Object Group with these items box. Enter a Name for it in the text field. Note: New object groups are not ready for immediate use. File: Manage Firewall Requests Page 4 of 7 Revised:

5 Make a selection form the Allow/Deny drop-down list. The default setting for the firewall rule is Allow. For Description, enter a short description in of what firewall rule does is and why access is needed. This is a required field. For Sensitive Data, select Yes or No from the drop-down list. This is a required field. 9. When you have made your selections, click Add. Note: A message will be displayed if you are missing information that is required to submit the Firewall rule request. 10. You can continue to submit new rules to the same outbound or inbound firewall zone by repeating steps six (6) through nine (9). When you have finished adding all the firewall rule requests for this zone, click Submit Firewall Rule Requests, then confirm your decision. Note: If you leave before submitting your firewall rule requests, your work will be lost. File: Manage Firewall Requests Page 5 of 7 Revised:

6 11. A Remedy ticket will be created for each rule that is requested. The ticket number will appear in the right column for each rule. Please take note of this number while it is displayed onscreen. Note: Remedy will also send you an To switch between requesting either Outbound or Inbound Firewall Rules, click the Zone Firewall Rules link on the right-hand menu, then use steps five (5) through eight (8) to make your requests for the other rule type. About Object Groups There are two types of Objects Groups: Network Object Groups (NOGs) which are a collection of IP addresses or subnet addresses which represent a zone. These are a logical grouping of hosts. Service Object Groups (SOGs) which are a collection of ports and protocols needed for a specific service (for example, file sharing or Symantec Antivirus). These are grouped together to make administration of firewall services easier. A key advantage for object groups is that they can be changed (rather than lists of IP addresses or rules) without requiring a downtime period Manage Object Groups New object groups are created as part of submitting a firewall rule (see the Create a Firewall Rule Request section for more details). To manage existing object groups: 1. Click Manage Object Groups. File: Manage Firewall Requests Page 6 of 7 Revised:

7 2. Select a Zone from the drop-down list. Note: This is done to determine the context level. You need to determine the zone in order to place the object group in its context level. 3. Select a Group Type. You can choose a Network Object Group (NOG) or Service Object Group (SOG). If Network Object Group (NOG) is selected: i. Select a Group from the drop-down list. ii. Provide an IP address, CIDR (range of IP addresses), or DNS. iii. Click the add item to list link. iv. To add more items to your member list, repeat steps ii. and iii, when you are done click Save. If Service Object Group (SOG) is selected: i. Select a Group from the drop-down list. ii. Provide a protocol (TCP, UDP or TCP/UDP). iii. Provide a port number. iv. Click the add item to list link. v. To add more items to your member list, repeat steps ii. through iv, when you are done click Save. 4. A message will be displayed onscreen with a Remedy ticket number. Please take note of this number while it is displayed onscreen. If you wish to see further information, access the Remedy ticketing systems and search using the ticket number. Note: You will also receive an message confirmation when the ticket is submitted. Get Help The Technology Help Desk at HELP [4357] is available 24-hours a day, seven days a week to answer your technology-related questions. Questions can also be submitted via the Web at technology.pitt.edu. File: Manage Firewall Requests Page 7 of 7 Revised: