Pedestrian question for setting up flexlm server to use ac..

[picard]

Archived from groups: comp.security.firewalls (More info?)

I am new to firewalls so please be kind.

Our company has software at a University site that has a number of
secure commercial member subnets. For obvious reasons, no connections
are permitted between the commercial subnets.

There are members in each subnet that want to use a specific software
package that is licensed to the University and is to be shared between
the commercial members. Using the software requires connecting to the
flexlm license server outside the subnet and taking the flexlm
floating license.

How can you set up the network so that each subnet can connect to the
common license server yet not have security risk of somebody
penetrating into a given subnet through the license server?

thanks!

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

jeanluc_picard_66@hotmail.com (picard) wrote in
news:8ff79ce0.0404081854.77a51860@posting.google.com:

> I am new to firewalls so please be kind.
>
> Our company has software at a University site that has a number of
> secure commercial member subnets. For obvious reasons, no connections
> are permitted between the commercial subnets.
>
> There are members in each subnet that want to use a specific software
> package that is licensed to the University and is to be shared between
> the commercial members. Using the software requires connecting to the
> flexlm license server outside the subnet and taking the flexlm
> floating license.
>
> How can you set up the network so that each subnet can connect to the
> common license server yet not have security risk of somebody
> penetrating into a given subnet through the license server?
>
> thanks!
>

If it is a server O/S such as Win 2K or Win 2K3, then you may be able to
implement IPsec on the server and set a filtering rule to allow inbound
from the subnet and outbound back to the originating subnet only on the
Windows Networking ports or other ports for that matter.

I think you should be able to set filtering rules such as the above for
each subnet. You can have multiple filtering rules active in a SecPol but
only one SecPol active on the machine.

IPsec can stop inbound or outbound by IP, port, protocol, DNS or subnet.

Simple

http://www.petri.co.il/block_ping_traffic_with_ipsec.htm

Advanced

http://www.analogx.com/contents/articles/ipsec.htm

With the AnalogX SecPol base template, you have examples of the PERMIT
rules which you can easily clone and make DENY rules. You know that Permit
inbound/Deny outbound kind of thing.

You can implement it on a workstation and try it.

I'll bet you it will work! <g>

Duane