Chapter 33: Whitelisting - Tavve zoneranger User Manual

Chapter 33: Whitelisting

Whitelisting is the ability to restrict information to be only from a specific set of addresses. The
ZoneRanger may be configured to only accept information from (Inbound) or send information to
(Outbound) a specific set of IP addresses. Especially for the ZR-SPX model ZoneRanger, the
configuration of a whitelist for Inbound information (SNMP Traps, Syslogs, etc) provides a security
measure for the ZoneRanger to only process information from a known set of IP addresses. When
whitelisting is enabled, only Inbound information which has a source address specified in the whitelist
will be processed by the ZoneRanger. All other Inbound information with source addresses which are
not in the whitelist will be ignored. This includes telnet, SSH, HTTP, and HTTPS requests.
It is able possible to configure the ZoneRanger to apply the whitelist to Outbound information. If
enabled, Outbound requests (SNMP requests, ICMP, requests, etc) must have their source addresses
specified in the whitelist. If the source address is not specified in the whitelist, the request will be
discarded. Special care needs to be taken when enforcing the whitelist for Outbound requests. This
enforcement will apply to all ZoneRanger initiated requests which include discovery, polling, joining,
diagnostics, as well as proxy requests. This also includes network services such as DNS and NTP that
will need to be added to the whitelist. However, joined Ranger Gateways and Redundant ZoneRangers
are automatically whitelisted even though they will not appear in the whitelist.
ZoneRanger 5.5 User's Guide 111