Skip to content Skip to site navigation

ITS Application Support - Windows Template Rules

Attention Application Owners & Rule Delegates

The following set of firewall policies, referred to as "Template Rules", are provided for administrators of Windows based servers that require a specific set of source hosts/nets and services allowed for administration.

When applying these Template rules, please consider any additional necessary "custom" policies to guarantee the inbound or outbound connectivity that servers will require. Those "custom" policy requests can be made via the Firewall Rule Request form.

Please contact the Firewall Team (firewall-team@lists.stanford.edu) with any questions.

Firewall Template Rules

Traffic Inbound to the Firewall
From To Ports Description
tsaw_av_servers DEST IP(s) tsaw_av SophosRMS (tcp:8192-8194)
 
tsaw_hips_servers DEST IP(s) tsaw_hips OSSEC (udp:1514)
g_su_admin_nets DEST IP(s) tsaw_ips NAT-T (udp:4500)
IKE (udp:500)
ESP (IP Proto 50)
AH (IP Proto 51)
 
tsaw_pbst_servers DEST IP(s) tsaw_pbst MS-RDP (tcp:3389)
MS-RDP-VM (tcp:2179)
WINS SVCS (tcp/udp:135,139,445)
IPMI RCMP (udp:623)
HTTPS (tcp:443) DRAC-Vmedia (tcp:3668)
DRAC-console (tcp:5900-5001)
WST-RPCserver (tcp:4900-5000)
WINRM (tcp:5985-5986)
 
tsaw_nagios_servers DEST IP(s) tsaw_nagios Nagios (tcp:5666)
 
tsaw_pbst_servers iDRAC DEST IP(s) tsaw_drac SSH (tcp:22)
IPMI (udp:623)
HTTP (tcp:80)
HTTPS (tcp:443)
DRAC-Vmedia (tcp:3668)
DRAC-Console (tcp:5900-5901)
tsaw_bigfix_r1_servers DEST IP(s) tsaw_bigfix BigFix (udp:52311)

Traffic Outbound from the Firewall

N/A

Group Object Definitions
Group Members
tsaw_av_servers tem2
smrwech01
smrwech02
smreech01
smreech02
tsaw_hips_servers ossec1
ossec2
tsaw_pbst_servers 171.67.47.32/27
171.67.47.128/28
e-pc-3
e-pc-5
tsaw_nagios_servers nagios01
nagios02
providence
tsaw_bigfix_r1_servers bigfixcore
 

Roles

Template Owner

Responsible for determining, maintaining and modifying the template rules and membership of the different server groups. The application owner is notified regarding any changes to the template.

Current Template Owners

  • Anne Pinkowski
  • Ross Wilper

System Administrators

Request rule approval from the application owner.

ISO Security

The ISO group will audit the rules and make recommendations as needed or upon request from either the System Administrators or the Application Owners. In addition, any changes to this template must be reviewed by ISO prior to implementation.

Last modified March 6, 2024