RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 26)

Oracle SBC Security Guide

 sftpForHDR - allows HDR to be accessed.

 sftpForAll - allows all logs to be accessed.

Furthermore, a new RADIUS authorization class is added for Acme-User-Class called SystemAdmin. It

shares the same permissions as admin except it cannot access security related information and issue

“show security” commands. The login prompt for this user is ACMEPACKET$.

The Security Admin license enables audit logs which provide data on all user driven system events such

as changes to configuration and public keys. It is recommended to configure push servers to SFTP audit

logs periodically to remote servers.

Configuration is detailed in the Administrative Essentials.

FIPS License

The Net-Net SBC provides cryptographic capabilities and algorithms that conform to Federal Information

Processing Standards (FIPS). Specific standards implemented include those described in Security

Requirements For Cryptographic Modules (FIPS PUB 140-2), and others described in NIST Special

Publication 800-90, Recommendation for Random Number Generation Using Deterministic Random Bit

Generators (Revised), March 2007.

This additional license may be required for deployments in military or civilian government environments.

Features added include power-on self-tests of encryption modules and software integrity, as well as use of

FIPS compliant cryptographic modules and random number generators.

Configuration of FIPS license support is detailed in Section 15 “Security” of the ACLI Configuration

Guide.

Configuring Monitoring and Performance Management

Features

SNMP

Simple Network Management Protocol (SNMP) is supported on the SBC Wancom0 management

interface for polling and traps. To secure your SNMP interface, it is recommended to use a community

name other than the standard “public”. Sufficiently obscure community names should adhere to the

customer’s corporate naming policies. Further, the list of configured SNMP polling servers and trap

receivers must be restricted to only those authorized (via SBC configuration) to manage the SBC. All

management stations used for SNMP access should have a permit ACL configured.

Further detail on SNMP traps and MIBS that should be examined can be found in Appendix H:

Configuration is detailed in Section 3 “System Configuration” of the ACLI Configuration Guide.

RADIUS Accounting

The SBC Wancom0 management interface uses RADIUS requests to send accounting and monitoring

data to remote RADIUS servers. For reliability, the SBC supports the configuration of multiple RADIUS

servers deployed in a number of HA schemes: hunt, failover, round robin, fastest round trip time (RTT)

and fewest pending.

The most appropriate scheme according to customer’s corporate policies should be chosen. It is

recommended that at least two RADIUS servers be deployed. The secret shared between the SBC and the

RADIUS server should be configured to be suitably obscure according to the customer’s corporate

1 2 ... 21 22 23 24 25 26 27 28 29 30 31 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 26