Bay Networks 6300 Supplement Manual page 300

Chapter 15 Using RA 6300 Security Book A
For profile criteria entries in which the only protocol specified is , as
cli
in the previous example, searches the file in sequential order and
erpcd
uses only the first entry whose profile criteria are met. For these types of
entries, order of placement in the file is important. If permission is granted
to a CLI connection request, the user follows the normal login procedure.
If the request is denied, the message Permission denied is displayed and
the session (job) is aborted.
For profile criteria specifications that explicitly specify or (or
slip ppp
implicitly specify them, by not specifying any protocol), filters are
automatically generated to restrict SLIP and/or PPP connections if either
protocol becomes active. Consider the following example:
username=*;protocol=slip: finance
In this example, all SLIP users on all RA 6300s are denied access to host
finance but are allowed access to all other hosts and host ports.
Given an address of 132.245.11.4 for host finance, the filters generated
to effect these restrictions are:
in include address_pair 132.245.11.4 * discard
out include address_pair 132.245.11.4 * discard
In the next example, the members of the group mail_only who connect
using the PPP or SLIP protocol (as opposed to the CLI) may access the
SMTP port (25) on host mailhub and the DNS server port (53) on the host
dns_srv, but they cannot access anything else.
group=mail_only;protocol=slip~ mailhub[25], dns_srv[53]
group=mail_only;protocol=ppp~ mailhub[25], dns_srv[53]
To put these restrictions into effect, the RA 6300 would generate the
following four filters, in which 132.245.33.1 is the address of mailhub
and 132.245.33.2 is the address of dns_srv.
in exclude address_pair 132.245.33.1 * port_pair 25 * discard
out exclude address_pair 132.245.33.1 * port_pair 25 * discard
in exclude address_pair 132.245.33.2 * port_pair 53 * discard
out exclude address_pair 132.245.33.2 * port_pair 53 * discard
Remote Annex 6300 Supplement to the Remote Annex Administrator's Guide for UNIX
A-272