D-Link DFL-260-IPS-12 Product Manual - Page 86
ICMP Services, Restrict Services to the Minimum Necessary, ICMP Types and Codes
View all D-Link DFL-260-IPS-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 86 highlights
3.2.3. ICMP Services Chapter 3. Fundamentals to refer to all protocols. However, using this is not recommended and specifying a narrower service provides better security. If, for example, the requirement is only to filter using the principal protocols of TCP, UDP and ICMP then the service group all_tcpudpicmp can be used instead. Tip: The http-all service does not include DNS A common mistake is to assume that the predefined service http-all includes the DNS protocol. It does not so the predefined service dns-all is usually also required for most web surfing. This could be included in a group with http-all and then associated with the IP rules that allow web surfing. Restrict Services to the Minimum Necessary When choosing a service object to construct a policy such as an IP rule, the protocols included in that object should be as few as necessary to achieve the traffic filtering objective. Using the all_services object may be convenient but removes any security benefits that a more specific service object could provide. The best approach is to narrow the service filter in a security policy so it allows only the protocols that are absolutely necessary. The all_tcpudpicmp service object is often a first choice for general traffic but even this may allow many more protocols than are normally necessary and the administrator can often narrow the range of allowed protocols further. Example 3.8. Creating a Custom TCP/UDP Service This example shows how to add a TCP/UDP service, using destination port 3306, which is used by MySQL: Command-Line Interface gw-world:/> add Service ServiceTCPUDP MySQL DestinationPorts=3306 Type=TCP Web Interface 1. Go to Objects > Services > Add > TCP/UDP service 2. Specify a suitable name for the service, for example MySQL 3. Now enter: • Type: TCP • Source: 0-65535 • Destination: 3306 4. Click OK 3.2.3. ICMP Services Another type of custom service that can be created is an ICMP Service. The Internet Control Message Protocol (ICMP) is a protocol that is integrated with IP for error reporting and transmitting control information. For example, the ICMP Ping feature uses ICMP to test Internet connectivity. ICMP Types and Codes 86