118 lines
7.3 KiB
HTML
118 lines
7.3 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE html
|
||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html lang="en-us" xml:lang="en-us">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
|
|
<meta name="security" content="public" />
|
||
|
|
<meta name="Robots" content="index,follow" />
|
||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
||
|
|
<meta name="DC.Type" content="concept" />
|
||
|
|
<meta name="DC.Title" content="iSeries Packet rules" />
|
||
|
|
<meta name="abstract" content="iSeries packet rules is an integrated feature of i5/OS available from the iSeries Navigator interface." />
|
||
|
|
<meta name="description" content="iSeries packet rules is an integrated feature of i5/OS available from the iSeries Navigator interface." />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zgiptraffic.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zgiptraffic.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="../rzajb/rzajbrzajb4natsd.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="../rzajb/rzajbrzajb0ippacketsecuritysd.htm" />
|
||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 1999, 2006" />
|
||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 1999, 2006" />
|
||
|
|
<meta name="DC.Format" content="XHTML" />
|
||
|
|
<meta name="DC.Identifier" content="rzaj45hpacketsecurity" />
|
||
|
|
<meta name="DC.Language" content="en-us" />
|
||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
|
|
<!-- US Government Users Restricted Rights -->
|
||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
||
|
|
<title>iSeries Packet
|
||
|
|
rules</title>
|
||
|
|
</head>
|
||
|
|
<body id="rzaj45hpacketsecurity"><a name="rzaj45hpacketsecurity"><!-- --></a>
|
||
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
||
|
|
<h1 class="topictitle1">iSeries Packet
|
||
|
|
rules</h1>
|
||
|
|
<div><p>iSeries™ packet
|
||
|
|
rules is an integrated feature of i5/OS™ available from the iSeries Navigator
|
||
|
|
interface.</p>
|
||
|
|
<p> The packet rules feature allows you to configure
|
||
|
|
two core network security technologies to control the flow of TCP/IP traffic
|
||
|
|
to protect your iSeries system:</p>
|
||
|
|
<ul><li>Network address translation (NAT)</li>
|
||
|
|
<li>IP packet filtering</li>
|
||
|
|
</ul>
|
||
|
|
<div class="p">Because NAT and IP filtering are integrated parts of your i5/OS, they provide
|
||
|
|
an economical way for you to secure your system. In some cases, these security
|
||
|
|
technologies may provide everything you need without any additional purchases.
|
||
|
|
These technologies, however, do not create a true, functional firewall. You
|
||
|
|
can use IP packet security alone, or in conjunction with a firewall, depending
|
||
|
|
on your security needs and objectives. <div class="note"><span class="notetitle">Note:</span> You should not attempt to take
|
||
|
|
advantage of the cost savings if you are planning to secure an iSeries production
|
||
|
|
system. For situations such as this, the security of your system should take
|
||
|
|
precedence over cost. To ensure that you provide maximum protection for your
|
||
|
|
production system, you should consider using a firewall.</div>
|
||
|
|
</div>
|
||
|
|
<div class="section"><h4 class="sectiontitle">What are NAT and IP packet filtering and how do they work
|
||
|
|
together?</h4><p><a href="../rzajb/rzajbrzajb4natsd.htm"><strong>Network
|
||
|
|
address translation (NAT)</strong></a> changes the source or the destination
|
||
|
|
IP addresses of packets that flow through the system. NAT provides a more
|
||
|
|
transparent alternative to the <a href="rzalxsecterms.htm">proxy</a> and <a href="rzalxsecterms.htm">SOCKS</a> servers of a firewall.
|
||
|
|
NAT can also simplify network configuration by enabling networks with incompatible
|
||
|
|
addressing structures to connect to each other. Consequently, you can use
|
||
|
|
NAT rules so that an iSeries system can function as a gateway between
|
||
|
|
two networks which have conflicting or incompatible addressing schemes. You
|
||
|
|
can also use NAT to hide the real IP addresses of one network by dynamically
|
||
|
|
substituting one or more addresses for the real ones. Because IP packet filtering
|
||
|
|
and NAT complement each other,
|
||
|
|
you will often use them together to enhance network security.</p>
|
||
|
|
<p>Using NAT can also make it
|
||
|
|
easier to operate a public web server behind a firewall. Public IP addresses
|
||
|
|
for the web server translate to private internal IP addresses. This reduces
|
||
|
|
the number of registered IP addresses that are required and minimizes impacts
|
||
|
|
to the existing network. It also provides a mechanism for internal users to
|
||
|
|
access the Internet while hiding the private internal IP addresses.</p>
|
||
|
|
<p><strong>IP
|
||
|
|
packet filtering</strong><span></span><span></span><span></span><span></span><span></span> provides the ability to selectively
|
||
|
|
block or protect IP traffic based on information in the packet headers. You
|
||
|
|
can use the Internet Setup Wizard in iSeries Navigator to quickly and easily
|
||
|
|
configure basic filtering rules to block unwanted network traffic.</p>
|
||
|
|
<p>You
|
||
|
|
can use IP packet filtering to do the following:</p>
|
||
|
|
<ul><li>Create a set of filter rules to specify which IP packets to permit into
|
||
|
|
your network and which to deny access into your network. When you create filter
|
||
|
|
rules, you apply them to a physical interface (for example, a Token ring or
|
||
|
|
Ethernet line). You can apply the rules to multiple physical interfaces, or
|
||
|
|
you can apply different rules to each interface.</li>
|
||
|
|
<li>Create rules to either permit or deny specific packets that are based
|
||
|
|
on the following header information: <ul><li>Destination IP address</li>
|
||
|
|
<li>Source IP address Protocol (for example, TCP, UDP, and so forth)</li>
|
||
|
|
<li>Destination port (for example, it is port 80 for HTTP)</li>
|
||
|
|
<li>Source port</li>
|
||
|
|
<li>IP datagram direction (inbound or outbound) </li>
|
||
|
|
<li>Forwarded or Local</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
<li>Prevent undesirable or unnecessary traffic from reaching applications
|
||
|
|
on the system. Also, you can prevent traffic from forwarding to other systems.
|
||
|
|
This includes low-level ICMP packets (for example, PING packets) for which
|
||
|
|
no specific application server is required.</li>
|
||
|
|
<li>Specify whether a filter rule creates a log entry with information about
|
||
|
|
packets that matches the rule in a system journal. Once the information writes
|
||
|
|
to a system journal, you cannot change the log entry. Consequently, the log
|
||
|
|
is an ideal tool for auditing network activity.</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div>
|
||
|
|
<div class="familylinks">
|
||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzaj45zgiptraffic.htm" title="Use this information to learn about the network level security measures that you should consider using to protect your internal resources.">Network security options</a></div>
|
||
|
|
</div>
|
||
|
|
<div class="relconcepts"><strong>Related concepts</strong><br />
|
||
|
|
<div><a href="rzaj45zgiptraffic.htm" title="Use this information to learn about the network level security measures that you should consider using to protect your internal resources.">Network security options</a></div>
|
||
|
|
<div><a href="../rzajb/rzajbrzajb4natsd.htm">Network address translation (NAT)</a></div>
|
||
|
|
<div><a href="../rzajb/rzajbrzajb0ippacketsecuritysd.htm">IP packet filtering</a></div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
</body>
|
||
|
|
</html>
|