ITS Application Support - Linux Template Rules

Attention Application Owners & Rule Delegates

The following set of firewall policies, referred to as "Template Rules", are provided for administrators of Windows based servers that require a specific set of source hosts/nets and services allowed for administration.

When applying these Template rules, please consider any additional necessary "custom" policies to guarantee the inbound or outbound connectivity that servers will require. Those "custom" policy requests can be made via the Firewall Rule Request form.

Please contact the Firewall Team (firewall-team@lists.stanford.edu) with any questions.

Firewall Template Rules

Traffic Inbound to the Firewall
From	To	Ports	Description
tsaa_afs_nets	tsaa_linux_hosts	tsaa_afs3-callback	AFS3 Callback (udp:7000-7010)
tsaa_bastion_hosts	tsaa_linux_hosts	tsaa_bastion_access	ssh (tcp:22) remctl (tcp:4373) IPMI (udp:623)
tsaa_nagios_servers	tsaa_linux_hosts	tsaa_nagios	Nagios monitoring (tcp:4373) NTP (udp:123)
tsaa_monitor_servers	tsaa_linux_hosts	tsaa_monitor	monitor (tcp:4949)

Traffic Outbound from the Firewall
From	To	Ports	Description
tsaa_linux_hosts	Untrust	tsaa_http(s)	http(s) (tcp:80 tcp:443)
tsaa_linux_hosts	Untrust	tsaa_bind	bind (tcp:53 udp:53)

Group Object Definitions
Group	Members
tsaa_bastion_hosts	appsup-dr dsintb
tsaa_afs_nets	171.64.7.0/24 171.64.17.0/24 171.67.16.0/22 171.67.20.0/24 171.67.22.0/24
tsaa_nagios_servers	nagios01 nagios02 providence
tsaa_monitor_servers	memory2

Roles

Template Owner

Responsible for determining, maintaining and modifying the template rules and membership of the different server groups. The application owner is notified regarding any changes to the template.

Current Template Owners

Anne Pinkowski
James Dornan
Tim Torgenrud

System Administrators

Request rule approval from the application owner.

ISO Security

The ISO group will audit the rules and make recommendations as needed or upon request from either the System Administrators or the Application Owners. In addition, any changes to this template must be reviewed by ISO prior to implementation.