13.6.15  
Remote control 
 

Teleworking with HG 1500 and pcAnywhere  

 Figure 13-8   Telecontrol with pcAnywhere
 
Symantec's pcAnywhere software enables remote operation of a PC in the network from an external PC.
Prerequisite:
 •   Windows 98/ME, Windows NT 4.0, 2000 or XP as the operating system
 •   Connection setup with the IP transport protocol
 •   PC is operational (if applicable, screen is dark)

13.6.15.1  
Safety Mechanisms ("Security") 
An access authorization for the routing function is required in order to control access via HG 1500 from the internal LAN to the ISDN and vice versa.
A firewall is not practical for telematic functions. Rules for these functions (for example trunk access) and their call numbers can be saved in HiPath 3000.
The following information is intended specifically for the router (HG 1500).

Station number verification (incoming only)  
Verification of the station number of the calling station (station authentication, configurable) and the IP address to prevent unauthorized external connections via ISDN.
Verification of the IP address (configurable) of internal LAN subscribers.

13.6.15.2  
Firewall 
A firewall is a barrier which protects against unauthorized access. In this case, the internal LAN (LAN1), for example, is to be protected against external access (such as Internet-based access via DSL).
The objective of a firewall configuration is to allow individual, specified computers to access an insecure network (for example Internet). At the same time, it prevents access in the reverse direction (from the Internet to these computers). The board features two different protection mechanisms for implementing this security.
The firewall in this case is a so-called authorization firewall. In other words, as soon as the firewall is activated, only configured components can access board services. All board services are automatically denied to unregistered LAN components.
WARNING: The activation and deactivation of firewall parameters may severely restrict the functionality of the board (for example LAN-based administration may not be possible any more) or may enable access to sensitive data.  

Firewall (Permit Firewall)  
In the case of a permit firewall, only configured components can access board services (when the firewall is activated). All board services are automatically denied to unregistered LAN components. The board features different protection mechanisms for implementing this security.
 •   Stateful packet filtering for communication with the LAN
Stateful packet filtering analyzes and, if necessary, rejects packets based on their source and target IP address addresses and the ports used (TCP, UDP, and ICMP port firewall). The IP addresses can be network addresses or individual hosts.
 •   Denial of Service Protection
Denial of Service Protection offers protection against a broad variety of Denial of Service attacks (and other attacks on the network gateway) such as SYN flooding, various fragmentation attacks, TCP hijacking (various active attacks, for example ARP spoofing), LAND (identical source and destination IPs), Christmas Tree attacks (all TCP flags are set), etc.
 •   MAC verification
    MAC address filters can limit access from devices within the LAN. If MAC filtering is enabled, devices such as these can only set up connections from the LAN via HG 1500 V3.0 whose IP and MAC addresses are explicitly released for this purpose.
An external firewall should be used if the demands for security on the firewall are higher (for example, if Internet and VPN traffic is being transferred to Internet gateways at the same time).  

13.6.15.3  
Alive Monitoring with Keep Alive 
The Keep Alive Test is used for HXG3 boards located in different network nodes. This test sends a ping signal to the other HXG3 boards and then waits for a return signal. If a return signal is not received from an HXG3 board (for example, because the IP connection is down) then the board is considered out of service. If this happens during call setup, a message is sent to the HiPath 3000 to set the call up again.
The connection is automatically cleared down if the connection exists already and the Keep Alive Test fails. This is especially important for data connections to ensure that the applications involved can react appropriately and do not stall.

13.6.15.4  
Monitoring IP Data Packages with rpcap and Wireshark (Ethereal) 

Tracing via the HIP interface  
The HIP interface (interface between HiPath 3000 and HG 1500) cannot be traced directly. However, external connections to the HIP interface via the LAN interfaces (LAN1: emac0 or LAN2: emac1) can be traced. When the rpcap service is launched, a server port of the HG 1500 opens. This enables direct access to TCP/IP packets by an IP trace tool such as e.g. Wireshark (Ethereal).
Wireshark is a program for analyzing network communication connections. It records data packages from HG 1500 and displays them in a table overview.

rpcap (Remote Packet Capture)  
The rpcap protocol permits programs such as Wireshark to run on the destination system as a server, recording data packets and transmitting them to a client. The client processes, analyzes and archives the data packets.

HiPath 3000/5000 V9, Service Documentation, Issue 7   up Top
Disclaimer & Copyright   ID: P31003H3590S100017620   2012-06-25