Multitech RF760 User's Guide download pdf (Page 142)

Appendix A – Disposition of Events

Multi-Tech Systems, Inc. RouteFinderVPN RF760/660/600VPN User Guide (PN S000323D) 142

1. Abstract

Disposition of Events

The LVPN RouteFinder 3.2x provides logging capabilities for various types of Access requests to the product.

The logging is classified as follows:

• Inbound Access Requests (LO1.A)

• Outbound Access Requests (LO1.B)

• Access Requests to Firewall Violating Security Policy (LO1.C)

• Access Requests Through Firewall Violating Security Policy (LO1.D)

• Administrative Authentication Log (LO1.E)

• Admin Port Access Requests (LO1.F)

• Startup History (LO1.G)

• User Defined Logs.

• Fragmented Packets Log. (ST6)

Access Request

An Access Request is the first packet arriving at the interface to which the security policy is applied. All subsequent packets

that are part of an ongoing session are not termed as access requests since an Access Request is the first packet that

establishes a session. Logging of an Access Request implies logging of the first packet of a session. Subsequent packets

are not logged.

Inbound Access Request

Each access request from the external network to the box for any services hosted by the box or hosted by an internal server

and have to pass through the firewall is termed as an inbound access request. Requests received on the WAN interface are

termed inbound access request. If the WAN interface is down and the dial backup PPP link is up, then a request received

on the PPP interface to the firewall will be termed inbound request access.

Access requests logged as Inbound Access Request correspond to LO1.A of Baseline module - version 4.0, ICSA Labs.

Figure 1 shows Inbound Access diagram

Figure 2 shows a snapshot of Inbound Access.

Figure 3 shows a snapshot of Inbound Access with DNAT and Connection Tracking.

Outbound Access Request

Each access request from the internal network (LAN/DMZ) to the external network (WAN) that passes through the firewall is

termed as an Outbound Access Request. All requests routed out through the WAN interface to servers connected on or

through the WAN Interface are considered Outbound Access Requests.

Access requests logged as Outbound Access Request correspond to LO1.B of Baseline module - version 4.0, ICSA Labs.

Figure 4 shows Outbound Access diagram.

Figure 5 shows a snapshot of Outbound Access

Figure 6 shows a snapshot of Outbound Access with connection tracking.

Access Requests through Firewall Violating Security Policy

An access request that traverses (routed through the firewall) but has to be dropped due to security restriction is logged as

Through Firewall dropped.

Access requests logged as Access Request through Firewall Violating Security Policy correspond to LO1.C of Baseline

module - version 4.0, ICSA Labs

Figure 7 show a snapshot of Through Firewall Dropped.

Access Request to Firewall Violating Security Policy

An Access request to the firewall can be dropped due to security restrictions. Each of these access requests is logged as To

Firewall Dropped.

Access requests logged as Access Request to Firewall Violating Security Policy correspond to LO1.D of Baseline module -

version 4.0, ICSA Labs.

Figure 8 shows To Firewall dropped diagram.

Figure 9 shows a snapshot of To Firewall Dropped.

Administrative Authentication Log

All successful and failed attempts to login to the VPN can be logged. The attempts are logged as Administrative

Authentication Log.

Administrative Authentication Log corresponds to LO1.E of Baseline module - version 4.0, ICSA Labs.

Figure 10 shows a snapshot of Administrative Authentication Log.

1 2 ... 137 138 139 140 141 142 143 144 145 146 147 ... 188 189

Comments to this Manuals

No comments

Multitech RF760 User's Guide Page 142

Comments to this Manuals

Related products and manuals for Gateways/controllers Multitech RF760