9.3.1 Basic information about firewalls

Before describing the operation in a firewall environment, this subsection provides basic information about firewalls.

If you run JP1 in a network environment that includes a firewall, you must evaluate support of two of the firewall functions:

Packet filtering (access permissions)

With packet filtering, only required communications are permitted and unauthorized communications are blocked.
NAT (address translation)

With NAT, an IP address is converted in order to connect to a network that has a different address. Connection cannot be made directly. In addition, the machine used to convert the IP address is hidden from the outside.

To evaluate support of these functions and to set up an environment, you must understand the method used by the firewall to control communications.

Important: The information provided here constitutes a simple overview intended to acquaint you with the basics of firewalls and does not provide sufficient detail for you to evaluate and set up an actual firewall. When you install a firewall, consult the firewall documentation as well as appropriate security documentation to evaluate and set up an environment.

Organization of this subsection

(1) Packet filtering
(2) NAT (address translation)
(3) Communication settings for a JP1 that is run in a firewall environment

(1) Packet filtering

The packet filtering function filters through the firewall the applications that can be used. It checks each communication packet that attempts to pass through the firewall and discards packets that do not satisfy the specified passage conditions, thereby blocking unauthorized communications from passing through the firewall. Only applications that are specified in the passage conditions can be used.

JP1/IM supports packet filtering.

(a) Setting packet filtering

To set packet filtering:

Check the communication method, such as the port numbers used by applications.

Check the port numbers, IP addresses, and passage directions that are set as the firewall passage conditions.

In the case of JP1/IM, check the communication method by referencing the information provided in this chapter and in Appendix C. Port Numbers in the JP1/Integrated Management 2 - Manager Overview and System Design Guide.
Set the passage conditions for the firewall.

Initially, you should prohibit all passage, then set passage conditions so that only specific applications can communicate through the firewall.

In the case of JP1/IM, set the JP1/IM communications checked in step 1 to pass the firewall.

(b) Example of settings for JP1/IM

This subsection describes the settings for packet filtering using an example of an environment in which there is a firewall between JP1/IM - View and JP1/IM - Manager.

Example: Connecting JP1/IM - View to JP1/IM - Manager via a firewall

The IP address of the JP1/IM - View machine is 192.168.19.37.
The IP address of the JP1/IM - Manager machine is 172.16.100.24.

The port numbers are JP1's default port numbers.

Figure 9‒5: Example of setting packet filtering

Check JP1's communication method.

First, check JP1's communication method, which is required for setting packet filtering. According to the information provided in Appendix C.2 Direction of communication through a firewall in the JP1/Integrated Management 2 - Manager Overview and System Design Guide, the port numbers used by JP1/IM are described as shown in the following table.

Table 9‒9: Firewall passage directions
Service name	Port number	Firewall passage direction
`jp1imevtcon`	`20115/tcp`	JP1/IM - View → JP1/IM - Manager (Central Console)
`jp1imcmda`	`20238/tcp`	JP1/IM - View → JP1/Base^#1 JP1/IM - Manager (Central Console) → JP1/Base^#1
`jp1imcss`	`20305/tcp`	JP1/IM - View → JP1/IM - Manager (Central Scope)
`jp1rmregistry`	`20380/tcp`	JP1/IM - View → JP1/IM - Rule Operation
`jp1rmobject`	`20381/tcp`	JP1/IM - View → JP1/IM - Rule Operation
`jp1imegs`	`20383/tcp`	Firewall setup is unnecessary because all communication takes place on the machine on which JP1/IM - Manager is installed.
`jddmain`	`20703/tcp`	Web browser → JP1/IM - Manager (Intelligent Integrated Management Base)
None^#2	Port number of the IM database^#3	JP1/IM - Manager (physical host) → JP1/IM - Manager (IM database (physical host))
None^#2	Port number of the IM database^#4	JP1/IM - Manager (logical host) → JP1/IM - Manager (IM database (logical host))
`jp1imcf`	`20702/tcp`	JP1/IM - View → JP1/IM - Manager (IM Configuration Management)
`jp1imfcs`	`20701/tcp`	Firewall setup is unnecessary because all communication takes place on the machine on which JP1/IM - Manager is installed.
`jimmail`	`25/tcp`^#5	JP1/IM - Manager → mail server (SMTP) (without authentication)
	`587/tcp`^#5	JP1/IM - Manager → mail server (SMTP) (with SMTP-AUTH authentication)
	`110/tcp`^#5	JP1/IM - Manager → mail server (POP3) (with POP-before-SMTP authentication)

Legend:: →: Direction of the connection when established

#1: Refers to JP1/Base on the manager.

#2: Not registered in the services file.

#3: This is the port number for the IM database (physical host) that was set in the setup information file when the IM database was set up on the physical host.

#4: This is the port number for the IM database (logical host) that was set in the cluster setup information file when the IM database was set up on the logical host.

#5: The destination port number might differ depending on which port is used on the destination server.

#6: The port number might differ depending on the HTTP server settings.

This table assumes the following communication method:

Service name and Port number columns

These are the service names and port numbers used by JP1 for communication. According to this table, port number 20115 (service name jp1imevtcon), port number 20238 (service name jp1imcmda), and port number 20305 (service name jp1imcss) are used, and TCP is used as the communication protocol for communication between JP1/IM - View and JP1/IM - Manager.
Firewall passage direction column

This column shows the direction of communication when connection begins (at the time connection is established). The direction for establishing connection is required in order to limit the firewall passage direction. For example, in No. 1 in this table, connection is permitted from JP1/IM - View to JP1/IM - Manager (Central Scope).
Other

Although it is not specified in the table, based on the information provided in the table and the TCP communication specifications, the following is true:

Because TCP is a bi-directional communications protocol, it involves two-way communications (JP1/IM - View to JP1/IM - Manager and JP1/IM - Manager to JP1/IM - View). In the source and destination packets of TCP communications, the source IP address and destination IP address are switched.

Set packet filtering.

Based on the direction of communication between JP1/IM - View and JP1/IM - Manager, set packet filtering in such a manner that only communications in the correct direction can pass through the firewall.

The passage conditions for packet filtering are as follows:

Example: Filtering condition: For JP1/IM - View and JP1/IM - Manager

Table 9‒10: Passage conditions for packet filtering
No.	Source IP address	Destination IP address	Protocol	Source port	Destination port	Control
1	`192.168.19.37`	`172.16.100.24`	`TCP`	`(ANY)`	`20115`	`accept`
2	`192.168.19.37`	`172.16.100.24`	`TCP`	`(ANY)`	`20238`	`accept`
3	`192.168.19.37`	`172.16.100.24`	`TCP`	`(ANY)`	`20305`	`accept`
4	`172.16.100.24`	`192.168.19.37`	`TCP`	`20115`	`(ANY)`	`accept`
5	`172.16.100.24`	`192.168.19.37`	`TCP`	`20238`	`(ANY)`	`accept`
6	`172.16.100.24`	`192.168.19.37`	`TCP`	`20305`	`(ANY)`	`accept`
7	`(ANY)`	`(ANY)`	`(ANY)`	`(ANY)`	`(ANY)`	`reject`

This table shows the conditions for checking packets and the control to be applied when the conditions are satisfied.

The Control column specifies whether the firewall permits (accept) or blocks (reject) the passage of packets. (ANY) means that any available port number assigned by the OS is to be used.

Set packet filtering for a firewall according to the filtering conditions shown in this table.

Note that the detailed setting method depends on the firewall. See your firewall documentation.

To Page Top

(2) NAT (address translation)

NAT (Network Address Translator) is a function for translating between private IP addresses and global IP addresses. By translating addresses, you can hide the private addresses from the outside, thereby improving internal machine security. NAT might be provided as a router function as well as a firewall function.

JP1 supports only static-mode NAT (method for translating addresses according to predefined rules).

(a) Setting NAT

To set NAT:

Check the IP addresses to be used.

First, check the IP addresses used by the applications. It is simple if a machine uses only one IP address. If there are multiple network adapters (using multiple IP addresses), or a logical IP address is used in a cluster system, the IP addresses to be used depend on the application.

In the case of JP1/IM, the IP addresses to be used depend on the settings, such as when communication settings are specified in JP1/Base, or a logical IP address is used for cluster operation.
Evaluate and set the address translation rules.

After you have checked the IP addresses used by the applications, determine the IP addresses obtained after translation.

Once you have determined rules for address change, set them in NAT.

(b) Example of settings for JP1/IM

This subsection describes the NAT settings based on an example of an environment in which there is a firewall between JP1/IM - View and JP1/IM - Manager.

Example: Connecting from JP1/IM - View to JP1/IM - Manager whose address has been translated

The IP address of the JP1/IM - View machine is 192.168.19.37.

The IP address of the JP1/IM - Manager machine is 172.16.100.24.

The IP address of this JP1/IM - Manager is translated to 192.168.100.24.

JP1/IM - View connects to 192.168.100.24 that is obtained after address translation.

Figure 9‒6: Example of NAT settings

Note: This is an example of address translation by NAT. Other translation methods are also available.

To set NAT:

Check the IP address to be used.

First, check the IP addresses used by JP1, which is required in order to set NAT.

This example uses the IP address that corresponds to the host name (host name displayed by executing the hostname command).

Evaluate and set the address translation rule.

Define the translation rule in such a manner that the IP address of the JP1/IM - Manager machine is translated from 172.16.100.24 to 192.168.100.24 by NAT.

Example: Address translation rule: Translating from 172.16.100.24 to 192.168.100.24

Table 9‒11: Address translation rule
No.	Source IP address	Destination IP address	Source IP address (translated)	Destination IP address (translated)
1	`(ANY)`	`192.168.100.24`	`(ANY)`	`172.16.100.24`
2	`172.16.100.24`	`(ANY)`	`192.168.100.24`	`(ANY)`

This table shows the correspondence between the source packet and the (translated) packet obtained after address translation.

Define this address translation rule in the NAT settings for the firewall.

Note that the detailed setting method depends on the firewall and router. See your product documentation.

JP1/IM - View accesses the address obtained after address translation (192.168.100.24), not the actual address of the JP1/IM - Manager machine (172.16.100.24).

Therefore, to JP1/IM - View, it appears that access is to the JP1/IM - Manager host whose address is 192.168.100.24.

To Page Top

(3) Communication settings for a JP1 that is run in a firewall environment

If you run JP1 in a network environment that includes a firewall, consider setting the JP1 communication method to the IP binding method and the effects of multi-LAN connection settings.

To run JP1 in a firewall environment, you must set IP address and port number conditions in packet filtering and NAT as discussed above.

The IP addresses used by JP1 must be clear. Therefore, the IP binding method that determines JP1's IP addresses by the JP1 settings is suitable.

For example, in a configuration in which the server that executes JP1 is connected to multiple LANs or in a cluster system configuration, the IP address to be used might be determined by the OS, resulting in an unintended IP address. In such a case, if you set JP1's communication method to the IP binding method, the IP address specified in the JP1 environment settings is always used for communication.

To Page Top