Arquitetura da rede do LSC: mudanças entre as edições
Ir para navegação
Ir para pesquisar
Sem resumo de edição |
Sem resumo de edição |
||
| Linha 20: | Linha 20: | ||
|} |
|} |
||
2) Regras de acesso a rede: |
|||
Extended IP access list fw-v1704-LSC-in (interface interna para rede externa) |
|||
10 permit udp any any eq bootps |
|||
20 permit tcp 150.162.57.0 0.0.0.63 any established |
|||
30 permit ip 150.162.57.0 0.0.0.63 150.162.0.0 0.0.255.255 |
|||
40 permit ip 150.162.57.0 0.0.0.63 150.162.242.0 0.0.0.255 |
|||
50 deny tcp any any eq smtp domain msrpc 136 137 138 139 445 |
|||
60 deny udp any any eq domain 135 136 netbios-ns netbios-dgm netbios-ss 445 |
|||
70 permit ip 150.162.57.0 0.0.0.63 any |
|||
Extended IP access list fw-v1704-LSC-out (interface externa para a rede interna) |
|||
{| class="wikitable" |
|||
10 deny ip 150.162.57.0 0.0.0.63 any |
|||
|- |
|||
20 permit tcp any any established |
|||
! Texto do cabeçalho !! Texto do cabeçalho !! Texto do cabeçalho |
|||
30 permit ip 150.162.0.0 0.0.3.255 any |
|||
|- |
|||
40 permit ip 150.162.242.0 0.0.0.255 any |
|||
| Exemplo || Exemplo || Exemplo |
|||
50 permit ip 150.162.0.0 0.0.255.255 host 150.162.57.3 |
|||
|- |
|||
60 permit ip 200.135.64.0 0.0.31.255 host 150.162.57.3 |
|||
| Exemplo || Exemplo || Exemplo |
|||
70 permit tcp any host 150.162.57.4 eq www 443 |
|||
|- |
|||
80 permit tcp any host 150.162.57.5 eq www 443 |
|||
| Exemplo || Exemplo || Exemplo |
|||
90 permit tcp host 150.162.60.140 host 150.162.57.5 eq smtp |
|||
|} |
|||
100 permit tcp any host 150.162.57.7 eq www 443 |
|||
110 permit tcp 150.162.0.0 0.0.255.255 150.162.57.0 0.0.0.7 eq 22 www 443 8080 8443 |
|||
120 permit tcp 200.135.64.0 0.0.31.255 150.162.57.0 0.0.0.7 eq 22 www 443 |
|||
130 permit tcp 150.162.0.0 0.0.255.255 host 150.162.57.8 eq 22 www 443 |
|||
140 permit tcp 200.135.64.0 0.0.31.255 host 150.162.57.8 eq 22 www 443 |
|||
150 permit udp host 150.162.2.4 range bootps bootpc any |
|||
160 permit udp any eq ntp any eq ntp |
|||
170 permit udp any any gt 1024 |
|||
180 permit icmp any any |
|||
190 permit udp host 150.162.6.25 range bootps bootpc any |
|||
200 permit ip host 150.162.6.25 any |
|||
3) Servidor DHCP na Setic: |
|||
57.1 a 57.10 --> ips fixos; |
|||
57.11 a 57.59 --> ips dinamicos; |
|||
57.60 e 57.61 --> não usar porque são a redundância de roteamento da rede do LSC |
|||
Edição das 19h12min de 31 de outubro de 2022
1) Dados da rede:
| 1704 LSC | ||
|---|---|---|
| INE - LSC | ||
| Network: 150.162.57.0 | ||
| 150.162.57.0/26 | * Servidores | Netmask: 255.255.255.192 (64 IPs) |
| * Desktops | Broadcast: 150.162.57.63 | |
| Gateway: 150.162.57.62 | ||
| IP's: 150.162.57.1 - 150.162.57.59 | ||
| VRRP: 150.162.57.60 e 57.61 |
2) Regras de acesso a rede:
Extended IP access list fw-v1704-LSC-in (interface interna para rede externa)
10 permit udp any any eq bootps 20 permit tcp 150.162.57.0 0.0.0.63 any established 30 permit ip 150.162.57.0 0.0.0.63 150.162.0.0 0.0.255.255 40 permit ip 150.162.57.0 0.0.0.63 150.162.242.0 0.0.0.255 50 deny tcp any any eq smtp domain msrpc 136 137 138 139 445 60 deny udp any any eq domain 135 136 netbios-ns netbios-dgm netbios-ss 445 70 permit ip 150.162.57.0 0.0.0.63 any
Extended IP access list fw-v1704-LSC-out (interface externa para a rede interna)
10 deny ip 150.162.57.0 0.0.0.63 any 20 permit tcp any any established 30 permit ip 150.162.0.0 0.0.3.255 any 40 permit ip 150.162.242.0 0.0.0.255 any 50 permit ip 150.162.0.0 0.0.255.255 host 150.162.57.3 60 permit ip 200.135.64.0 0.0.31.255 host 150.162.57.3 70 permit tcp any host 150.162.57.4 eq www 443 80 permit tcp any host 150.162.57.5 eq www 443 90 permit tcp host 150.162.60.140 host 150.162.57.5 eq smtp 100 permit tcp any host 150.162.57.7 eq www 443 110 permit tcp 150.162.0.0 0.0.255.255 150.162.57.0 0.0.0.7 eq 22 www 443 8080 8443 120 permit tcp 200.135.64.0 0.0.31.255 150.162.57.0 0.0.0.7 eq 22 www 443 130 permit tcp 150.162.0.0 0.0.255.255 host 150.162.57.8 eq 22 www 443 140 permit tcp 200.135.64.0 0.0.31.255 host 150.162.57.8 eq 22 www 443 150 permit udp host 150.162.2.4 range bootps bootpc any 160 permit udp any eq ntp any eq ntp 170 permit udp any any gt 1024 180 permit icmp any any 190 permit udp host 150.162.6.25 range bootps bootpc any 200 permit ip host 150.162.6.25 any
3) Servidor DHCP na Setic:
57.1 a 57.10 --> ips fixos;
57.11 a 57.59 --> ips dinamicos;
57.60 e 57.61 --> não usar porque são a redundância de roteamento da rede do LSC