3Com OfficeConnect 3C16771 User Manual page 105

The more specific, the better. For example, if traffic is being
allowed from the Internet to the LAN, it is better to allow
only certain machines on the Internet to access the LAN.
Once you have defined the logic of the rule, it is critical to
consider the security ramifications created by the rule:
Will this rule stop LAN users from accessing critical
I
resources on the Internet?
For example, if IRC is blocked, are there users that
require this service?
Is it possible to modify the rule to be more specific?
I
For example, if IRC is blocked for all users, will a rule
that blocks just certain users be more effective?
Will this rule allow Internet users access to resources on
I
the LAN in a manner that may create an undue security
vulnerability?
For example, if NetBIOS ports (UDP 137, 138, 139) are
allowed from the Internet to the LAN, Internet users
may be able to connect to PCs with file sharing
enabled.
Does this rule conflict with any existing rules?
I
Once you have answered these questions, to add rules
you type the information into the correct boxes in the
Policy Rules window.
a Action
Select the Allow or Deny option button depending on
the intent of the rule, as defined by item 2 in the
"Network Access Rule Logic List"
b Service
From the Service menu, select the IP protocol, as defined
by item 4 in the
page 104. If the protocol is not listed, it is necessary to
first define it in the Add Service window.
"Network Access Rule Logic List"
Policy Rules
on page 104.
105
on