Security Groups - HP LCS60 Installation Manual

Security Groups

The LCS60 provides a mechanism for allocating IP addresses from one or more
pools of addresses. Each address pool is associated with a unique IP network
security group and is used to limit user access to the LAN.
This feature allows the LCS60 administrator to define up to four IP networks that
an LCS60 user can select when dialing in for either SLIP service or IP over PPP
service. Each IP network is associated one for one with a dkserver service name.
This name must be entered in the following databases:
LCS60 in which the dkserver name is referred to as an IP network security
group. One of these IP network security groups is required to match the
UNIX node uname value.
Data switch controller database as a local CPM host address, all associated
with the same CPM group.
Network Access Controller (NAC) as a host name (if security is required).
The NAC database is used to authorize members of a particular user group to
create calls to the LCS60 host name represented by the IP network security group
name. Generally, all those users who share common IP network access privileges
are assigned to a NAC user group; the NAC is set up to present the group
members a menu of LCS60 hosts they are permitted to call.
The IP routers connected to the same Ethernet LAN as an LCS60 are configured
to filter/secure IP traffic flow on the basis of an arriving packet's source IP net-
work address. A user's source IP address is assigned by the LCS60 (or subject to
verification, it can be nominated by the user) when the SLIP or PPP session is
started.
An LCS60 is required to have an IP network security group whose name matches
the LCS60's UNIX node name; this is referred to as the uname IP network secu-
rity group. As a consequence, the ipas script requests that you configure the
uname security group's IP network address before you are allowed to add any
other IP network security group. When editing the uname IP network security
group, the ipas script prevents you from altering its name; if you want to edit
this attribute, use the nodename script. Any change in the UNIX node name is
automatically applied to the uname IP network security group name and any of
its associated reserved IP addresses. You are not allowed to delete the uname IP
network security group because other LCS60 services depend on its dkserver
process being present.
Issue 3
Multiple IP Subnetworks
1-15