C-A OPERATIONS PROCEDURES MANUAL C-AD Firewalls for Isolated Networks. Attachments. Hand Processed Changes. HPC No. Date Page Nos.

Transcription

1 If you are using a printed copy of this procedure, and not the on-screen version, then you MUST make sure the dates at the bottom of the printed copy and the on-screen version match. The on-screen version of the Collider-Accelerator Department Procedure is the Official Version. Hard copies of all signed, official, C-A Operating Procedures are available by contacting the ESSHQ Procedures Coordinator, Bldg. 911A C-A OPERATIONS PROCEDURES MANUAL C-AD Firewalls for Isolated Networks Attachments Hand Processed Changes HPC No. Date Page Nos. Initials Approved: Signature With Date on File Collider-Accelerator Department Chairman Date N. Franco C-A-OPM Page 1 of 8 Revision 01

2 C-AD Firewalls for Isolated Networks 1. Purpose 1.1 The purpose of this procedure is to establish a standard practice for implementing a configurable firewall appliance/device that logically isolates any special purpose networks in C-AD. 2. Responsibilities 2.1 The C-AD Communications and Electronic Support (CADCES), group is responsible for building any firewall or device that monitors or purposely restricts C-AD network traffic. 2.2 The CADCES group is responsible for implementing firewall devices on the C- AD network by working with the System Owner (SO) to ensure accurate packet filtering is in place. 2.3 The Cyber Security Officer (CSO), is responsible for assembling a ruleset approval committee made up of the CADCES Network Engineer, the SO, and the CSO, and others as needed. 2.4 The SO is responsible for approving the proper functioning of the application with the ruleset in place. 2.5 The CSO is responsible for approving the ruleset as tested and accurate before implementing packet filtering with the approved ruleset. Approval record must be maintained via the Open Source Ticket Request System (OTRS), by the CSO. 2.6 The CADCES Network Engineer is responsible for implementing the ruleset and enabling packet filtering on the firewall device. Logs files must be reviewed after enabling packet filtering to ensure proper communications is apparent. 3. Prerequisites 3.1 The CADCES Network staff must be familiar with UNIX-based systems and the proper configuration of a firewall device with this OS (see Attachment 8.1). 3.2 The SO must be familiar with required network communications of their system in order to ensure proper functionality after packet filtering is enabled. 4. Precautions None C-A-OPM Page 2 of 8 Revision 01 July 9, 2014

3 5. Procedure 5.1 Requirements for setting up a firewall to isolate networks in C-AD 6. Documentation Medium grade general purpose personal computer loaded with UNIX Operating System in accordance with BNL basic cyber security requirements. See: C-A-OPM , Configuration Control of C-AD Network Enabled Devices The CADCES, group must develop and maintain the packet filter ruleset in a revision control system. The ruleset files will be retained on the Controls System Network Accessible Storage (NAS) server using a revision controls system (RCS), to provide check-in, check-out, and archival controls The Ruleset must be reviewed, tested, and approved before the packet filter is implemented by CADCES into an operational run state. The OTRS will be used to initiate a ruleset change request and required approvals before the ruleset can be implemented and the ticket closed An OTRS ticket must be generated within 24 hours of an approved emergency ruleset change due to extenuating circumstances or emergency remediation of an isolated subnet. 6.1 Revision controlled and archived copy of the ruleset must be maintained on the Controls NAS Server. 6.2 OTRS must be used to retain record of approved changes to packet filter rulesets. 7. References 7. C-A-OPM , Configuration Control of C-AD Network Enabled Devices. 8. Attachments 8.1 Configuration and enabling of packet filtering on a BSD Firewall. 8.2 Sample: Packet Filter Ruleset for the ACS isolation. C-A-OPM Page 3 of 8 Revision 01

4 Attachment 8.1 Configuration and Enabling of Packet Filtering on a BSD Firewall. Once the Operating System (OS) is installed and functional, there are only a few steps needed to get the firewall functioning. 1. Enable IP forwarding sysctl net.inet.ip.forwarding=1 2. To keep that setting valid through system reboots, uncomment the following line in /etc/sysctl.conf: net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of IPv4 packets 3. Create a bridge interface. This allows the firewall to run with no changes to the existing network infrastructure. Create a file named /etc/hostname.bridge0 containing the following 3 lines: add em0 add em1 up The names em0 and em1 are the names of the firewall network interfaces. Additional information on bridging firewalls can be found at: 4. Enable the packet filter to run upon reboots Add the following to /etc/rc.conf.local: pf="yes" 5. Build a ruleset. Complete and current documentation can be found at: 6. Load and enable the ruleset with the following command: pfctl -ef /etc/pf.conf 7. Rulesets can be reloaded after modifications using the following command: pfctl -f /etc/pf.conf C-A-OPM Page 4 of 8 Revision 01 July 9, 2014

5 Attachment 8.2 Sample: Packet Filter Ruleset for ACS Isolation Firewall Definition: The ACS firewall has 3 network adapters; one adapter is used as a management interface to allow system administrators to administer the device on the network. This interface resides on the IP address of The other 2 network interfaces are used for the purpose of packet filtering. One is connected to the C-AD router known as the external interface, exposed to the general network. The other interface is connected to the ACS network distribution switch known as the internal interface, connected to an isolated network. Egress traffic is defined as moving from the isolated network to the general network, and ingress traffic is moving from the general network to the isolated network. Filter Definitions: acs_network = /24 all rules are tcp traffic only unless otherwise noted. Section 1 - ITD Systems Trend Antivirus trend_servers: tr8.bnl.gov itd-trend6.bnl.gov itd-trend11.bnl.gov Rule #1: acs_network => trend_servers:8080 (egress) Rule #2: trend_servers => acs_network:32260 (ingress) ITD Domain Services ports 80 - http 88 - kerberos 135 epmap netbios-dgm netbios-ssn 389 ldap microsoft-ds msft-gc ITD Domain Controllers: bnl-dns1.itd.bnl.gov bnl-dns2.itd.bnl.gov bnldc-515.itd.bnl.gov bnldc0.itd.bnl.gov bnldc1.itd.bnl.gov bnldccore.itd.bnl.gov Rule #3 acs_network > ITD domain controllers:ports (egress) (tcp and udp) C-A-OPM Page 5 of 8 Revision 01

6 ITD Management servers ITD Management Server Ports: 80 - http netbios-ssn microsoft-ds ITD Management Servers bnlnt1a.b459.bnl.gov bnlnt1b.b459.bnl.gov sao-landeskcore.b459.bnl.gov Rule #4 acs_network > ITD Management servers : ITD Management Server Ports (egress) Traffic existing on these ports considered unneccesary. sms-itd.bnl.gov 80,445 (sms beinge phased out) smtpgateway.sec.bnl.local 25,80,445 ( ) ITD WSUS Windows Update Service port 80 ITD WSUS Servers: wsus.b459.bnl.gov wsus3-itd.b459.bnl.gov Rule #5 acs_network > ITD WSUS Servers :80 (egress) Section 2 - CAD Networks Java Portal to Controls Name Server (Wenge?) Rule #6 pass-safety-100.c-ad.bnl.gov > acnlin92.pbn.bnl.gov:9600 (egress) Joe P. backup of IRIS database. Rule #7 acnlin9e.pbn.bnl.gov > pass-safety-device41.c-ad.bnl.gov:13724 (ingress) Rule #8 pass-safety-device41.c-ad.bnl.gov > acnlin9e.pbn.bnl.gov:13724 (egress) CADCES nfs gateway NFS Clients: pass-safety-pc2.c-ad.bnl.gov Rule #9 NFS Clients > c-adnfsgw1.c-ad.bnl.gov:139,445 (egress) C-A-OPM Page 6 of 8 Revision 01

7 Passlogger Passlogger Clients: pass-safety-100.c-ad.bnl.gov pass-safety-pc17.c-ad.bnl.gov Rule #10: Passlogger Clients > passlogger.c-ad.bnl.gov:445 (egress) CAD-NAS Rule #11: pass-safety-device41.c-ad.bnl.gov > c-adnas01.c-ad.bnl.gov:139,445 (egress) DNS Services DNS Servers: (ITD) (ITD) Rule # 12: acs_network > DNS Servers : 53 (egress) (tcp and udp) Outside Time Sync Use CAD ntp service which runs on Controls name servers. NTP Servers: acnbsd01.pbn.bnl.gov acnbsd02.pbn.bnl.gov acnbsd03.pbn.bnl.gov acnbsd04.pbn.bnl.gov Rule #13 acs_network > NTP Servers :123 (egress) (tcp and udp) Network Monitors Network Monitor Servers: netxray.s108.bnl.gov cisco.pbn.bnl.gov Rule #14: Network Monitor Servers > acs_network (ingress) (icmp, ip) C-A-OPM Page 7 of 8 Revision 01

8 Management Interface, not part of the ACS ruleset Sytem Admin PCs: Rule #15: System Admin PCs > :22 Rule #16: Allow outbound traffic from management interface Approvals that the packet filter ruleset has been tested and verified accurate. Approval: CADCES Network Engineer date: Approval: System Owner (SO) date: Approval: C-AD Cyber Security Officer (CSO) date: C-A-OPM Page 8 of 8 Revision 01