Filter
Top Products
Chapter 29 - Maintaining The Router
Gauntlet Security
RX1100 owners can use the Gauntlet security appliance to restrict access to critical
assets. This section details how to activate Gauntlet and determine currently
negotiated sessions. Details and recommendations on applying the Gauntlet system
to networking may be found in texts referenced in the About This Guide section of
the user guide.
What And How Gauntlet Protects
Gauntlet protects against unauthorized access to critical assets, including the router
itself. Gauntlet allows connection from known management devices to assets behind
the firewall operating on known TCP/UDP port numbers. Gauntlet does not encrypt
communications which occur in the clear, such as the Telnet protocol. Protocols such
as SSH and HTTPS offer their own encryption and are suitable for use with Gauntlet.
Gauntlet And The Firewall
Gauntlet integrates tightly with the firewall, opening it for communications between
vetted clients and critical assets on a demand basis. There are three steps in
activating the Gauntlet security appliance.
1) The rrsetup utility must be used to configure a Gauntlet passphrase. See the
chapter “Setting Up And Administering The Router” for more details.
2) The gauntlet daemon must be enabled in the Bootup and Shutdown Menu.
3) The firewall must be configured with some default rules required by the appliance,
and then activated or restarted.
Shorewall requires you to assign the router interfaces to zones and then control traffic
between these zones.
Typically, the zone for wan interfaces is named "net" while the zone for local
interfaces is named "loc". The following instructions assume those names.
The gauntlet daemon requires rules for certain ports (shown below) to be installed.
Contact RuggedCom support for assistance if you wish to reassign these ports.
• Visit the Shorewall Network Zones sub-menu and create the net and loc
IPv4 zones.
• Visit the Network Interfaces sub-menu and assign interfaces to the zones.
• Visit the Default Policies sub-menu and assign the following policies:
Source zone Destination zone Policy
fw any ACCEPT
loc net ACCEPT
all any REJECT
• Visit the Firewall Rules sub-menu and assign the following rules:
Action Source zone Destination zone Protocol Src-Port Dst-Port
ACCEPT net fw UDP any 20000
ACCEPT net fw UDP any 30000
Gauntlet net loc
Gauntlet net fw TCP any 21000
Gauntlet net fw TCP any 21002
Gauntlet net fw TCP any 10000
RuggedCom 261