netscreen 5GT simple question

[peterve]

Hi,

How can I see *all* firewall rules on my netscreen 5GT ?
When I look under "policies", I only see the rules that I've created, but I don't see a "deny all" rule, I don't see the rules that allow for remote (http, ssh, ...) management and so on...

thanks

--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[Packet7]

Hello,

You can see all your policies from the CLI. Type "get pol". If you want to see policies between specific zones, add them after "pol". For example, "get pol from trust to untrust" will show you all your outbound policies. The implicit deny is a global policy and configured for inbound traffic by default. Regarding HTTP, Telnet and SSH management, it is assigned to the interface. You can type "get int trust" to see what is enabled. If needed you can also had additional services. For example, to enable telnet use "set int trust manage telnet". Hope this helps.

Rgds,

John

 

[peterve]

so there is no way to see all policies in one view, including the implicit rule and ports that are used on an interface basis ?

thanks

--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[Packet7]

I don't think so.

Rgds,

John

 

[peterve]

If I would create those rules myself, at the bottom of the ruleset
- allow ports for administration
- block everything else

Would those custom rules overrule the implicit rules ?
In other words, if I would add a "catch all" rule as last rule, would that cut off administration into the box ?


--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[Packet7]

Hi,

Administration to the box is not controlled via policies. You simply enable or disable protocols (HTTP/HTTPs, Telenet, SSH, etc) on the Interface. Also, you can lock it down to specific IP or Netblocks by clicking Configuration, Admin, Permitted IPs. Just make sure you permit the IP of the machine you are connected to first. If not, you will be disconnected! Hope this helps.

Rgds,

John