O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

2.4. Control Access to the Firewall

Problem

Users in different parts of the enterprise, or distributed NOC/SOC centers, must manage the firewall, and they must be able to access common services.

Solution

Determine the interface(s) that will accept management traffic, and then configure the management protocols to be accepted:

	top-ssg140-> set interface e0/0 manage ping
	top-ssg140-> set interface e0/0 manage ssh
	top-ssg140-> set interface e0/2 manage ping
	top-ssg140->set interface e0/0 manage-ip 10.251.7.100

Next, determine how the firewall will reach management services:

	top-ssg140-> set syslog src-interface e0/0
	top-ssg140-> set ntp server src-interface e0/0
	top-ssg140-> set snmp host public 10.251.7.113/32 src-interface e0/0
	top-ssg140-> set tftp source-interface e0/0
	top-ssg140->set nsmgmt server primary 10.251.7.113 src-interface
	    e0/0

Now, define which network host(s) and/or address(es) can access the firewall:

	top-ssg140-> set admin manager-ip 10.100.41.0/24
	top-ssg140-> set admin manager-ip 10.100.100.200/32
	top-ssg140-> set admin manager-ip 10.100.100.201/32
	top-ssg140-> set admin manager-ip 10.100.29.3/32
	top-ssg140-> set admin manager-ip 10.251.7.96/27
	top-ssg140->set admin manager-ip 192.168.30.0/24

Change the root admin account, and configure individual admins:

	top-ssg140-> set admin name <root_adminname> password <password>
	top-ssg140-> set admin user name <adminname> password <password>
	    privilege all
	top-ssg140->set admin user name <adminname> password <password> privilege ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required