- Differentiating Rules for Inbound/Outbound Dialogs and for TCP/UDP Protocols
- Initialized Security Environment
- Determining the Current TCP/IP End System Security State
- Enabling or Disabling TCP/IP End System Security
- Loading a Rules File
- Changing to Another Rules File
- Reviewing Security Rule Violations
- Authorizing the Use of Well-Known TCPIP Ports
An administrator can invoke a security facility to monitor and control TCP/IP traffic to and from ClearPath MCP servers. Such security is critical in today's Internet-oriented operating environment. Unrestricted access can result in compromised data, corrupted program or data files, and serious service disruptions.
TCP/IP end system security applies to the TCP, UDP, and ICMP protocols, with both IPv4 and IPv6 addresses.
When TCP/IP end system security is running, the TCPIPSECURITY library controls the TCP/IP security function. Essentially, security is maintained by evaluating every TCP/IP dialog establishment against a set of Deny and Allow rules provided in an active rules file.
-
If the TCPIPSECURIY library is SLed, end system security is enabled. Otherwise, it is disabled.
-
If TCP/IP end system security is enabled and there is no active rules file, complete security is assured and all TCP/IP dialog establishment requests will fail.
-
If there is an active rules file, then
-
A request fails if it matches a Deny rule.
-
A request fails if it does not match any Deny or Allow rule.
-
A request is allowed if it matches an Allow rule and did not match any previous Deny rule.
-
For every request failure, a TCP/IP SECURITY REPORT log entry is made in the SUMLOG.
The system security administrator must establish system-specific security rules, encode them in a rules file, provide ongoing maintenance of these rules, and regularly analyze the rule violations reported in the SUMLOG. For details about these security‑related tasks, refer to the MCP Security Overview and Implementation Guide. Note that any number of rules files can be defined; however, only one rules file can be in use at any time.
You can add, delete, modify, and test rules files by using the MCP TCP/IP Filtering component of Security Center. Refer to the MCP Security Overview and Implementation Guide and the Security Center Help for information on using MCP TCP/IP Filtering.
