|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
|
|
3
|
<firewall name="/usr/share/era/modeles/5zones-AixMars.xml" model="/usr/share/era/modeles/5zones.xml" version="2.42">
|
|
4
|
<zones>
|
|
5
|
</zones>
|
|
6
|
<include>
|
|
7
|
iptables -t nat -N NONAT
|
|
8
|
iptables -t nat -I NONAT -j ACCEPT
|
|
9
|
iptables -t nat -I PREROUTING ! -i eth0 -d 10.0.0.0/8 -j NONAT
|
|
10
|
iptables -t nat -I PREROUTING -d 172.16.0.0/12 -j NONAT
|
|
11
|
iptables -t nat -I PREROUTING -d 192.168.0.0/16 -j NONAT
|
|
12
|
iptables -t nat -I PREROUTING -d 161.48.0.0/19 -j NONAT
|
|
13
|
iptables -t nat -I PREROUTING -d 79.174.192.22/32 -j NONAT
|
|
14
|
iptables -t nat -I PREROUTING -d 79.174.192.38/32 -j NONAT
|
|
15
|
iptables -t nat -I PREROUTING -d 195.221.236.208/32 -j NONAT
|
|
16
|
iptables -t nat -I PREROUTING -d 83.97.61.199/32 -j NONAT
|
|
17
|
iptables -t nat -I PREROUTING -d 83.97.61.244/32 -j NONAT
|
|
18
|
type_etab=$(CreoleGet type_etab)
|
|
19
|
if [ "$type_etab" = "Lycee_Region" ] ; then
|
|
20
|
iptables -t nat -I PREROUTING -d 10.40.0.0/16 -j RETURN
|
|
21
|
fi
|
|
22
|
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
|
|
23
|
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 80 --tcp-flags SYN,RST,ACK SYN ! -d %%adresse_ip_eth0/32 -j REDIRECT --to-ports 3128
|
|
24
|
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
|
|
25
|
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN ! -d %%adresse_ip_eth0/32 -j REDIRECT --to-ports 3128
|
|
26
|
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
|
|
27
|
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 8080 --tcp-flags SYN,RST,ACK SYN ! -d %%adresse_ip_eth0/32 -j REDIRECT --to-ports 3128
|
|
28
|
iptables -D pub-bas -d %%adresse_ip_eth4/32 -i eth4 -p tcp -m state --state NEW -m tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
29
|
iptables -I ext-bas -d %%adresse_ip_eth0/32 -p tcp -m tcp --dport 8062 -j DROP
|
|
30
|
if [ -e /usr/share/era/ipset-tor ] ; then
|
|
31
|
. /usr/share/era/ipset-tor &> /dev/null
|
|
32
|
iptables -I OUTPUT -o eth0 -p tcp -m tcp -m set --match-set bastion-tor dst -j DROP
|
|
33
|
iptables -I FORWARD -o eth0 -p tcp -m tcp -m set --match-set bastion-tor dst -j DROP
|
|
34
|
fi
|
|
35
|
if [ "$type_etab" = "CG13" ] ; then
|
|
36
|
iptables -t nat -A POSTROUTING -o eth0 -s 10.231.0.0/255.255.0.0 -j SNAT --to-source %%adresse_ip_eth0
|
|
37
|
fi
|
|
38
|
if [ -e /etc/sysconfig/regles-locales ] ; then
|
|
39
|
. /etc/sysconfig/regles-locales
|
|
40
|
fi
|
|
41
|
</include>
|
|
42
|
<services>
|
|
43
|
<service name="EDT" protocol="tcp" ports="49500" id="73" libelle="EDT-tcp" tcpwrapper=""/>
|
|
44
|
<service name="EDT-udp" protocol="udp" ports="55200" id="74" libelle="EDT-udp" tcpwrapper=""/>
|
|
45
|
<service name="Kav_WOL" protocol="udp" ports="60000" id="70" libelle="WakeOnLan Kaspersky" tcpwrapper=""/>
|
|
46
|
<service name="absence_9000" protocol="tcp" ports="9000" id="46" libelle="absence_9000" tcpwrapper=""/>
|
|
47
|
<service name="agent_kav" protocol="tcp" ports="14000" id="47" libelle="agent_kav" tcpwrapper=""/>
|
|
48
|
<service name="agent_kav_ssl" protocol="tcp" ports="13000" id="65" libelle="agent_kav_ssl" tcpwrapper=""/>
|
|
49
|
<service name="ead_4201" protocol="tcp" ports="4201" id="76" libelle="Acces backend EAD" tcpwrapper=""/>
|
|
50
|
<service name="http80" protocol="tcp" ports="80" id="71" libelle="port 80 (le nom de service http est deja utilise dans le modele dijon donc on utilise le nom http80)" tcpwrapper=""/>
|
|
51
|
<service name="https443" protocol="tcp" ports="443" id="72" libelle="port 443 (le nom de service http est deja utilise dans le modele dijon donc on utilise le nom https443)" tcpwrapper=""/>
|
|
52
|
<service name="impression" protocol="tcp" ports="9100" id="75" libelle="port imprimantes" tcpwrapper=""/>
|
|
53
|
<service name="kav_control_client" protocol="udp" ports="15000" id="68" libelle="" tcpwrapper=""/>
|
|
54
|
<service name="ldap_ssl" protocol="tcp" ports="636" id="101" libelle="service d'annuaire" tcpwrapper=""/>
|
|
55
|
<service name="ldap_tcp" protocol="tcp" ports="389" id="67" libelle="service d'annuaire" tcpwrapper=""/>
|
|
56
|
<service name="ldap_udp" protocol="udp" ports="389" id="64" libelle="service d'annuaire" tcpwrapper=""/>
|
|
57
|
<service name="ntp_tcp" protocol="tcp" ports="123" id="48" libelle="ntp_tcp" tcpwrapper=""/>
|
|
58
|
<service name="ntp_udp" protocol="udp" ports="123" id="49" libelle="ntp_udp" tcpwrapper=""/>
|
|
59
|
<service name="pronote_49300" protocol="tcp" ports="49300" id="50" libelle="pronote_49300" tcpwrapper=""/>
|
|
60
|
<service name="pronote_8000" protocol="tcp" ports="8000" id="51" libelle="pronote_8000" tcpwrapper=""/>
|
|
61
|
<service name="snmp_tcp" protocol="tcp" ports="161-162" id="52" libelle="snmp_tcp" tcpwrapper=""/>
|
|
62
|
<service name="snmp_udp" protocol="udp" ports="161-162" id="53" libelle="snmp_udp" tcpwrapper=""/>
|
|
63
|
<service name="ssh_exterieur" protocol="tcp" ports="25000" id="69" libelle="ssh sur dmz depuis l'exterieur" tcpwrapper=""/>
|
|
64
|
<service name="trend_cnnx_client" protocol="tcp" ports="13000" id="100" libelle="connexion du client trend à son serveur" tcpwrapper=""/>
|
|
65
|
<service name="trend_cnnx_console" protocol="tcp" ports="4343" id="99" libelle="port de connexion du client à la console TREND" tcpwrapper=""/>
|
|
66
|
<service name="zwook_443" protocol="tcp" ports="443" id="63" libelle="zwwok_443" tcpwrapper=""/>
|
|
67
|
<service name="zwook_80" protocol="tcp" ports="80" id="62" libelle="zwook_80" tcpwrapper=""/>
|
|
68
|
<service name="zwook_9080" protocol="tcp" ports="9080" id="61" libelle="zwook_9080" tcpwrapper=""/>
|
|
69
|
<groupe id="EDT" libelle="acces EDT depuis exterieur">
|
|
70
|
<service name="EDT" protocol="tcp" ports="49500" id="73" libelle="EDT-tcp" tcpwrapper=""/>
|
|
71
|
<service name="EDT-udp" protocol="udp" ports="55200" id="74" libelle="EDT-udp" tcpwrapper=""/>
|
|
72
|
</groupe>
|
|
73
|
<groupe id="gr_ead_AixMars" libelle="groupe EAD (8501, 4200, 4201)">
|
|
74
|
<service name="ead_4201" protocol="tcp" ports="4201" id="76" libelle="Acces backend EAD" tcpwrapper=""/>
|
|
75
|
</groupe>
|
|
76
|
<groupe id="gr_kav" libelle="Agent Kaspersky">
|
|
77
|
<service name="agent_kav" protocol="tcp" ports="14000" id="47" libelle="agent_kav" tcpwrapper=""/>
|
|
78
|
<service name="agent_kav_ssl" protocol="tcp" ports="13000" id="65" libelle="agent_kav_ssl" tcpwrapper=""/>
|
|
79
|
</groupe>
|
|
80
|
<groupe id="gr_kav_control" libelle="Kaspersky Controle des Clients et WakeOnLan">
|
|
81
|
<service name="Kav_WOL" protocol="udp" ports="60000" id="70" libelle="WakeOnLan Kaspersky" tcpwrapper=""/>
|
|
82
|
<service name="kav_control_client" protocol="udp" ports="15000" id="68" libelle="" tcpwrapper=""/>
|
|
83
|
</groupe>
|
|
84
|
<groupe id="gr_ldap" libelle="service d'annuaire TCP et UDP">
|
|
85
|
<service name="ldap_tcp" protocol="tcp" ports="389" id="67" libelle="service d'annuaire" tcpwrapper=""/>
|
|
86
|
<service name="ldap_udp" protocol="udp" ports="389" id="64" libelle="service d'annuaire" tcpwrapper=""/>
|
|
87
|
</groupe>
|
|
88
|
<groupe id="gr_ntp" libelle="gr_ntp">
|
|
89
|
<service name="ntp_tcp" protocol="tcp" ports="123" id="48" libelle="ntp_tcp" tcpwrapper=""/>
|
|
90
|
<service name="ntp_udp" protocol="udp" ports="123" id="49" libelle="ntp_udp" tcpwrapper=""/>
|
|
91
|
</groupe>
|
|
92
|
<groupe id="gr_pronote_ext" libelle="gr_pronote_ext">
|
|
93
|
<service name="pronote_49300" protocol="tcp" ports="49300" id="50" libelle="pronote_49300" tcpwrapper=""/>
|
|
94
|
<service name="pronote_8000" protocol="tcp" ports="8000" id="51" libelle="pronote_8000" tcpwrapper=""/>
|
|
95
|
</groupe>
|
|
96
|
<groupe id="gr_snmp" libelle="Snmp en TCP et UDP">
|
|
97
|
<service name="snmp_tcp" protocol="tcp" ports="161-162" id="52" libelle="snmp_tcp" tcpwrapper=""/>
|
|
98
|
<service name="snmp_udp" protocol="udp" ports="161-162" id="53" libelle="snmp_udp" tcpwrapper=""/>
|
|
99
|
</groupe>
|
|
100
|
<groupe id="gr_trend" libelle="ports utilisé par les clients TREND">
|
|
101
|
<service name="trend_cnnx_client" protocol="tcp" ports="13000" id="100" libelle="connexion du client trend à son serveur" tcpwrapper=""/>
|
|
102
|
<service name="trend_cnnx_console" protocol="tcp" ports="4343" id="99" libelle="port de connexion du client à la console TREND" tcpwrapper=""/>
|
|
103
|
</groupe>
|
|
104
|
<groupe id="gr_www" libelle="http et https">
|
|
105
|
<service name="http80" protocol="tcp" ports="80" id="71" libelle="port 80 (le nom de service http est deja utilise dans le modele dijon donc on utilise le nom http80)" tcpwrapper=""/>
|
|
106
|
<service name="https443" protocol="tcp" ports="443" id="72" libelle="port 443 (le nom de service http est deja utilise dans le modele dijon donc on utilise le nom https443)" tcpwrapper=""/>
|
|
107
|
</groupe>
|
|
108
|
<groupe id="gr_zwook" libelle="gr_zwook">
|
|
109
|
<service name="zwook_80" protocol="tcp" ports="80" id="62" libelle="zwook_80" tcpwrapper=""/>
|
|
110
|
<service name="zwook_9080" protocol="tcp" ports="9080" id="61" libelle="zwook_9080" tcpwrapper=""/>
|
|
111
|
<service name="zwook_443" protocol="tcp" ports="443" id="63" libelle="zwwok_443" tcpwrapper=""/>
|
|
112
|
</groupe>
|
|
113
|
</services>
|
|
114
|
<qosclasses upload="" download="">
|
|
115
|
</qosclasses>
|
|
116
|
<extremites>
|
|
117
|
<extremite zone="privdmz" name="ip_acces_vpn_dmzpri" libelle="Adresse destination acces VPN DMZ privée" netmask="%%netmask_acces_vpn_dmzpri" subnet="1" type="" interface="" container="">
|
|
118
|
<ip address="%%ip_acces_vpn_dmzpri"/>
|
|
119
|
</extremite>
|
|
120
|
<extremite zone="admin" name="ip_acces_vpn_admin" libelle="Adresse destination acces VPN reseau admin" netmask="%%netmask_acces_vpn_admin" subnet="1" type="" interface="" container="">
|
|
121
|
<ip address="%%ip_acces_vpn_admin"/>
|
|
122
|
</extremite>
|
|
123
|
<extremite zone="exterieur" name="ip_source_acces_vpn_dmzpri" libelle="Adresse source de l'acces au reseau DMZ privée par VPN" netmask="%%netmask_source_acces_vpn_dmzpri" subnet="1" type="" interface="" container="">
|
|
124
|
<ip address="%%ip_source_acces_vpn_dmzpri"/>
|
|
125
|
</extremite>
|
|
126
|
<extremite zone="pedago" name="ip_pronote_peda" libelle="ip srv note sur le peda" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
127
|
<ip address="%%ip_pronote_peda"/>
|
|
128
|
</extremite>
|
|
129
|
<extremite zone="privdmz" name="ip_spipzwook_dmzpri" libelle="srv ip spipzwook dmzpri" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
130
|
<ip address="%%ip_spipzwook_dmzpri"/>
|
|
131
|
</extremite>
|
|
132
|
<extremite zone="exterieur" name="ip_source_acces_vpn_peda" libelle="Adresse source de l'acces au reseau peda par VPN" netmask="%%netmask_source_acces_vpn_peda" subnet="1" type="" interface="" container="">
|
|
133
|
<ip address="%%ip_source_acces_vpn_peda"/>
|
|
134
|
</extremite>
|
|
135
|
<extremite zone="pubdmz" name="ip_edt_dmzpub" libelle="Serveur EDT en dmz pub" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
136
|
<ip address="%%ip_edt_dmzpub"/>
|
|
137
|
</extremite>
|
|
138
|
<extremite zone="pubdmz" name="serveur_web" libelle="Serveur web sur DMZ publique" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
139
|
<ip address="%%ip_web_dmzpub"/>
|
|
140
|
</extremite>
|
|
141
|
<extremite zone="bastion" name="ip_bastion_eth1" libelle="IP bastion eth1" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth1" container="ip">
|
|
142
|
<ip address="%%adresse_ip_eth1"/>
|
|
143
|
</extremite>
|
|
144
|
<extremite zone="bastion" name="ip_bastion_eth0" libelle="adresse IP eth0" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth1" container="ip">
|
|
145
|
<ip address="%%adresse_ip_eth0"/>
|
|
146
|
</extremite>
|
|
147
|
<extremite zone="pedago" name="ip_scribe_peda" libelle="Serveur Scribe en zone péda" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
148
|
<ip address="%%ip_scribe_peda"/>
|
|
149
|
</extremite>
|
|
150
|
<extremite zone="privdmz" name="ip_edt_dmzpri" libelle="Serveur EDT en dmz pri" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
151
|
<ip address="%%ip_edt_dmzpri"/>
|
|
152
|
</extremite>
|
|
153
|
<extremite zone="pedago" name="ip_srv_antivirus" libelle="adresse IP du serveur antivirus" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
154
|
<ip address="%%ip_srv_antivirus"/>
|
|
155
|
</extremite>
|
|
156
|
<extremite zone="privdmz" name="ip_pronote_dmzpri" libelle="ip srv note en dmz prive" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
157
|
<ip address="%%ip_pronote_dmzpri"/>
|
|
158
|
</extremite>
|
|
159
|
<extremite zone="admin" name="ip_amon_eth1" libelle="IP Amon eth1" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
160
|
<ip address="%%adresse_ip_eth1"/>
|
|
161
|
</extremite>
|
|
162
|
<extremite zone="privdmz" name="ip_scribe_pri" libelle="Serveur Scribe en DMZ privée" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
163
|
<ip address="%%ip_scribe_pri"/>
|
|
164
|
</extremite>
|
|
165
|
<extremite zone="pubdmz" name="ip_srv_dmzpub_cas" libelle="Serveur DMZ publique en mode CAS" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
166
|
<ip address="%%ip_srv_dmzpub_cas"/>
|
|
167
|
</extremite>
|
|
168
|
<extremite zone="pedago" name="ETH0_peda" libelle="Eth0 pour DNAT vers peda" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
169
|
<ip address="%%adresse_ip_eth0"/>
|
|
170
|
</extremite>
|
|
171
|
<extremite zone="privdmz" name="ip_srv_antivirus_dmz" libelle="adresse IP du serveur antivirus en DMZ" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
172
|
<ip address="%%ip_srv_antivirus_dmz"/>
|
|
173
|
</extremite>
|
|
174
|
<extremite zone="pubdmz" name="ssh_dmzpub" libelle="Serveur SSH sur DMZ publique" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
175
|
<ip address="%%ip_ssh_dmzpub"/>
|
|
176
|
</extremite>
|
|
177
|
<extremite zone="pubdmz" name="ip_spipzwook_dmzpub" libelle="ip srv zwook dmz pub" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
178
|
<ip address="%%ip_spipzwook_dmzpub"/>
|
|
179
|
</extremite>
|
|
180
|
<extremite zone="pubdmz" name="ip_acces_vpn_dmzpub" libelle="Adresse destination acces VPN DMZ publique" netmask="%%netmask_acces_vpn_dmzpub" subnet="1" type="" interface="" container="">
|
|
181
|
<ip address="%%ip_acces_vpn_dmzpub"/>
|
|
182
|
</extremite>
|
|
183
|
<extremite zone="pedago" name="PC_supervision" libelle="Station supervision des lycées" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
184
|
<ip address="%%ip_supervision"/>
|
|
185
|
</extremite>
|
|
186
|
<extremite zone="pubdmz" name="srv_absence" libelle="Serveur Absence port 9000" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
187
|
<ip address="%%ip_absence_dmzpub"/>
|
|
188
|
</extremite>
|
|
189
|
<extremite zone="admin" name="imprimantes_acces_peda" libelle="imprimantes admin accesibles du reseau peda" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
190
|
<ip address="%%ip_imprimantes_acces_peda"/>
|
|
191
|
</extremite>
|
|
192
|
<extremite zone="pubdmz" name="ip_srv_pub_antivirus" libelle="IPs des serveurs à proteger en DMZ pub" netmask="%%netmask_srv_pub_antivirus" subnet="1" type="" interface="" container="">
|
|
193
|
<ip address="%%ip_srv_pub_antivirus"/>
|
|
194
|
</extremite>
|
|
195
|
<extremite zone="pedago" name="ip_sauv_nas" libelle="ip serveur a sauvegarder" netmask="%%netmask_sauv_nas" subnet="1" type="" interface="" container="">
|
|
196
|
<ip address="%%ip_sauv_nas"/>
|
|
197
|
</extremite>
|
|
198
|
<extremite zone="privdmz" name="ip_srv_pri_antivirus" libelle="adresses IP des serveurs à proteger en DMZ prive" netmask="%%netmask_srv_pri_antivirus" subnet="1" type="" interface="" container="">
|
|
199
|
<ip address="%%ip_srv_pri_antivirus"/>
|
|
200
|
</extremite>
|
|
201
|
<extremite zone="privdmz" name="ETH0_dmzpri" libelle="Eth0 pour DNAT vers peda" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
202
|
<ip address="%%adresse_ip_eth0"/>
|
|
203
|
</extremite>
|
|
204
|
<extremite zone="pedago" name="ip_amon_eth2" libelle="IP Amon eth2" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
205
|
<ip address="%%adresse_ip_eth2"/>
|
|
206
|
</extremite>
|
|
207
|
<extremite zone="exterieur" name="ip_source_acces_vpn_dmzpub" libelle="Adresse source de l'acces au reseau DMZ publique par VPN" netmask="%%netmask_source_acces_vpn_dmzpub" subnet="1" type="" interface="" container="">
|
|
208
|
<ip address="%%ip_source_acces_vpn_dmzpub"/>
|
|
209
|
</extremite>
|
|
210
|
<extremite zone="privdmz" name="ip_srv_dmzpri_cas" libelle="Serveur DMZ privée en mode CAS" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
211
|
<ip address="%%ip_srv_dmzpri_cas"/>
|
|
212
|
</extremite>
|
|
213
|
<extremite zone="pubdmz" name="ETH0_DMZPUB" libelle="Eth0 pour DNAT vers DMZ PUB" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
214
|
<ip address="%%adresse_ip_eth0"/>
|
|
215
|
</extremite>
|
|
216
|
<extremite zone="admin" name="ip_srv_antivirus_adm" libelle="IP du serveur antivirus sur le reseau admin" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
217
|
<ip address="%%ip_srv_antivirus_adm"/>
|
|
218
|
</extremite>
|
|
219
|
<extremite zone="pubdmz" name="ip_pronote_dmzpub" libelle="ip srv note en dmz pub" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
220
|
<ip address="%%ip_pronote_dmzpub"/>
|
|
221
|
</extremite>
|
|
222
|
<extremite zone="pedago" name="Vlans_Peda" libelle="Reseau Global Vlan Peda" netmask="%%netmask_global_vlanpeda" subnet="1" type="" interface="" container="">
|
|
223
|
<ip address="%%adresse_global_vlanpeda"/>
|
|
224
|
</extremite>
|
|
225
|
<extremite zone="privdmz" name="ip_nas" libelle="ip du serveur nas" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
226
|
<ip address="%%ip_nas"/>
|
|
227
|
</extremite>
|
|
228
|
<extremite zone="exterieur" name="ip_source_acces_vpn_admin" libelle="Adresse source de l'acces au reseau admin par VPN" netmask="%%netmask_source_acces_vpn_admin" subnet="1" type="" interface="" container="">
|
|
229
|
<ip address="%%ip_source_acces_vpn_admin"/>
|
|
230
|
</extremite>
|
|
231
|
<extremite zone="pedago" name="ip_acces_vpn_peda" libelle="Adresse destination acces VPN reseau peda" netmask="%%netmask_acces_vpn_peda" subnet="1" type="" interface="" container="">
|
|
232
|
<ip address="%%ip_acces_vpn_peda"/>
|
|
233
|
</extremite>
|
|
234
|
<extremite zone="pedago" name="ip_edt_peda" libelle="serveur EDT sur reseau peda" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
235
|
<ip address="%%ip_edt_peda"/>
|
|
236
|
</extremite>
|
|
237
|
<extremite zone="exterieur" name="reseau_rectorat" libelle="Reseau du Rectorat" netmask="255.255.254.0" subnet="1" type="" interface="" container="">
|
|
238
|
<ip address="195.83.252.0"/>
|
|
239
|
</extremite>
|
|
240
|
</extremites>
|
|
241
|
<ranges>
|
|
242
|
</ranges>
|
|
243
|
<user_groups>
|
|
244
|
<user_group name="professeurs" id="10001"/>
|
|
245
|
<user_group name="élèves" id="10002"/>
|
|
246
|
</user_groups>
|
|
247
|
<applications>
|
|
248
|
<app_group name="Navigateur Web" description="Liste des navigateurs web">
|
|
249
|
<app name="Internet Explorer"/>
|
|
250
|
<app name="Firefox"/>
|
|
251
|
<app name="AutresNav"/>
|
|
252
|
</app_group>
|
|
253
|
<application name="AutresNav" description="Autres navigateurs">
|
|
254
|
<path name="C:\Program Files\*opera*"/>
|
|
255
|
</application>
|
|
256
|
<application name="Firefox" description="Navigateur Mozilla Firefox">
|
|
257
|
<path name="C:\Program Files\*firefox*"/>
|
|
258
|
<path name="/usr/bin/*firefox*"/>
|
|
259
|
</application>
|
|
260
|
<application name="Internet Explorer" description="Navigateur Internet Explorer">
|
|
261
|
<path name="C:\Program Files\Internet Explorer\*ieplorer*"/>
|
|
262
|
</application>
|
|
263
|
</applications>
|
|
264
|
<flux-list>
|
|
265
|
<flux zoneA="bastion" zoneB="exterieur">
|
|
266
|
<montantes default_policy="0">
|
|
267
|
</montantes>
|
|
268
|
<descendantes default_policy="1">
|
|
269
|
</descendantes>
|
|
270
|
</flux>
|
|
271
|
<flux zoneA="exterieur" zoneB="admin">
|
|
272
|
<montantes default_policy="0">
|
|
273
|
<directive tag="acces_vpn_admin" service="tous" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser acces depuis client VPN vers admin" ipsec="0" accept="0">
|
|
274
|
<source name="ip_source_acces_vpn_admin"/>
|
|
275
|
<destination name="ip_acces_vpn_admin"/>
|
|
276
|
</directive>
|
|
277
|
</montantes>
|
|
278
|
<descendantes default_policy="1">
|
|
279
|
<directive service="tous" priority="6" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
280
|
<source name="admin_restreint"/>
|
|
281
|
<destination name="exterieur"/>
|
|
282
|
</directive>
|
|
283
|
</descendantes>
|
|
284
|
</flux>
|
|
285
|
<flux zoneA="bastion" zoneB="admin">
|
|
286
|
<montantes default_policy="0">
|
|
287
|
<directive tag="activer_lightsquid" service="lightsquid" priority="13" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser lightsquid pour eth1" ipsec="0" accept="0">
|
|
288
|
<source name="admin_admin"/>
|
|
289
|
<destination name="ip_bastion_eth0"/>
|
|
290
|
</directive>
|
|
291
|
</montantes>
|
|
292
|
<descendantes default_policy="1">
|
|
293
|
</descendantes>
|
|
294
|
</flux>
|
|
295
|
<flux zoneA="exterieur" zoneB="pedago">
|
|
296
|
<montantes default_policy="0">
|
|
297
|
<directive tag="Acces_Station_Supervision" service="tous" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Acces a la station de supervision (Lycée)" ipsec="0" accept="0">
|
|
298
|
<source name="exterieur"/>
|
|
299
|
<destination name="PC_supervision"/>
|
|
300
|
</directive>
|
|
301
|
<directive tag="acces_vpn_peda" service="tous" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser acces depuis client VPN vers peda" ipsec="0" accept="0">
|
|
302
|
<source name="ip_source_acces_vpn_peda"/>
|
|
303
|
<destination name="ip_acces_vpn_peda"/>
|
|
304
|
</directive>
|
|
305
|
<directive tag="entpeda" service="ldap" priority="3" action="8" attrs="17" nat_extr="ip_scribe_peda" nat_port="389" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour LDAP depuis Seshat vers ENT péda" ipsec="0" accept="0">
|
|
306
|
<source name="reseau_rectorat"/>
|
|
307
|
<destination name="ETH0_peda"/>
|
|
308
|
</directive>
|
|
309
|
<directive tag="entpeda" service="ldaps" priority="4" action="8" attrs="17" nat_extr="ip_scribe_peda" nat_port="636" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour LDAPS depuis Seshat vers ENT péda" ipsec="0" accept="0">
|
|
310
|
<source name="reseau_rectorat"/>
|
|
311
|
<destination name="ETH0_peda"/>
|
|
312
|
</directive>
|
|
313
|
<directive tag="entpeda" service="eole-sso" priority="5" action="8" attrs="17" nat_extr="ip_scribe_peda" nat_port="8443" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour SSO vers ENT péda" ipsec="0" accept="0">
|
|
314
|
<source name="exterieur"/>
|
|
315
|
<destination name="ETH0_peda"/>
|
|
316
|
</directive>
|
|
317
|
</montantes>
|
|
318
|
<descendantes default_policy="1">
|
|
319
|
<directive tag="intercopeda" service="tous" priority="11" action="16" attrs="17" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="SNAT pour le reseau global péda" ipsec="0" accept="0">
|
|
320
|
<source name="Vlans_Peda"/>
|
|
321
|
<destination name="exterieur"/>
|
|
322
|
</directive>
|
|
323
|
</descendantes>
|
|
324
|
</flux>
|
|
325
|
<flux zoneA="admin" zoneB="pedago">
|
|
326
|
<montantes default_policy="0">
|
|
327
|
<directive tag="kav_control_ped" service="gr_kav_control" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="kaspersky controle et WakeOnLan des clients admin à partir du server Kav Peda" ipsec="0" accept="0">
|
|
328
|
<source name="ip_srv_antivirus"/>
|
|
329
|
<destination name="admin"/>
|
|
330
|
</directive>
|
|
331
|
<directive tag="imprimantes_ped_vers_adm" service="impression" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise l'acces aux imprimantes réseau depuis le réseau pedago" ipsec="0" accept="0">
|
|
332
|
<source name="pedago"/>
|
|
333
|
<destination name="imprimantes_acces_peda"/>
|
|
334
|
</directive>
|
|
335
|
<directive tag="kav_ped_vers_adm" service="gr_kav" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser zone peda dialoguer avec serveur kav admin" ipsec="0" accept="0">
|
|
336
|
<source name="pedago"/>
|
|
337
|
<destination name="ip_srv_antivirus_adm"/>
|
|
338
|
</directive>
|
|
339
|
<directive tag="trend_control_ped" service="gr_trend" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="controles des postes trend depuis le serveur peda vers l'admin" ipsec="0" accept="0">
|
|
340
|
<source name="ip_srv_antivirus"/>
|
|
341
|
<destination name="admin"/>
|
|
342
|
</directive>
|
|
343
|
<directive tag="trend_ped_vers_adm" service="gr_trend" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser client TREND de PEDA vers ADMIN" ipsec="0" accept="0">
|
|
344
|
<source name="pedago"/>
|
|
345
|
<destination name="ip_srv_antivirus_adm"/>
|
|
346
|
</directive>
|
|
347
|
</montantes>
|
|
348
|
<descendantes default_policy="1">
|
|
349
|
</descendantes>
|
|
350
|
</flux>
|
|
351
|
<flux zoneA="bastion" zoneB="pedago">
|
|
352
|
<montantes default_policy="0">
|
|
353
|
<directive tag="AdminDepuisEth2" service="eole-sso" priority="14" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Authentification SSO sur eth1 depuis reseau pedago pour l'EAD" ipsec="0" accept="0">
|
|
354
|
<source name="pedago_admin"/>
|
|
355
|
<destination name="ip_bastion_eth1"/>
|
|
356
|
</directive>
|
|
357
|
<directive tag="activer_lightsquid" service="lightsquid" priority="15" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser peda vers lightsquid" ipsec="0" accept="0">
|
|
358
|
<source name="pedago_admin"/>
|
|
359
|
<destination name="ip_bastion_eth0"/>
|
|
360
|
</directive>
|
|
361
|
</montantes>
|
|
362
|
<descendantes default_policy="1">
|
|
363
|
</descendantes>
|
|
364
|
</flux>
|
|
365
|
<flux zoneA="exterieur" zoneB="privdmz">
|
|
366
|
<montantes default_policy="0">
|
|
367
|
<directive tag="acces_vpn_dmzpri" service="tous" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser acces depuis client VPN vers DMZ pri" ipsec="0" accept="0">
|
|
368
|
<source name="ip_source_acces_vpn_dmzpri"/>
|
|
369
|
<destination name="ip_acces_vpn_dmzpri"/>
|
|
370
|
</directive>
|
|
371
|
<directive tag="entdmzpri" service="ldap" priority="2" action="8" attrs="17" nat_extr="ip_scribe_pri" nat_port="389" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour LDAP depuis Seshat vers ENT dmz privée" ipsec="0" accept="0">
|
|
372
|
<source name="reseau_rectorat"/>
|
|
373
|
<destination name="ETH0_dmzpri"/>
|
|
374
|
</directive>
|
|
375
|
<directive tag="entdmzpri" service="ldaps" priority="3" action="8" attrs="17" nat_extr="ip_scribe_pri" nat_port="636" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour LDAPS depuis Seshat vers ENT dmz privée" ipsec="0" accept="0">
|
|
376
|
<source name="reseau_rectorat"/>
|
|
377
|
<destination name="ETH0_dmzpri"/>
|
|
378
|
</directive>
|
|
379
|
<directive tag="entdmzpri" service="eole-sso" priority="4" action="8" attrs="17" nat_extr="ip_scribe_pri" nat_port="8443" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour SSO vers ENT dmz privée" ipsec="0" accept="0">
|
|
380
|
<source name="exterieur"/>
|
|
381
|
<destination name="ETH0_dmzpri"/>
|
|
382
|
</directive>
|
|
383
|
</montantes>
|
|
384
|
<descendantes default_policy="1">
|
|
385
|
<directive service="tous" priority="6" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="SNAT pour l'acces des serveurs DMZ privés vers l'exterieur" ipsec="0" accept="0">
|
|
386
|
<source name="privdmz_restreint"/>
|
|
387
|
<destination name="exterieur"/>
|
|
388
|
</directive>
|
|
389
|
<directive service="gr_redirection_http" priority="7" action="4" attrs="0" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
390
|
<source name="privdmz"/>
|
|
391
|
<destination name="exterieur_bastion"/>
|
|
392
|
</directive>
|
|
393
|
<directive service="gr_redirection_http" priority="8" action="4" attrs="0" nat_port="81" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux vers le serveur de distribution du fichier wpad" ipsec="0" accept="0">
|
|
394
|
<source name="privdmz"/>
|
|
395
|
<destination name="exterieur"/>
|
|
396
|
</directive>
|
|
397
|
<directive service="gr_redirection_https" priority="9" action="4" attrs="0" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
398
|
<source name="privdmz"/>
|
|
399
|
<destination name="exterieur"/>
|
|
400
|
</directive>
|
|
401
|
</descendantes>
|
|
402
|
</flux>
|
|
403
|
<flux zoneA="admin" zoneB="privdmz">
|
|
404
|
<montantes default_policy="0">
|
|
405
|
<directive tag="kav_control_pri" service="gr_kav_control" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Kaspersky controle et WakeOnLan des clients admin à partir du server Kav en DMZpri" ipsec="0" accept="0">
|
|
406
|
<source name="ip_srv_antivirus_dmz"/>
|
|
407
|
<destination name="admin"/>
|
|
408
|
</directive>
|
|
409
|
<directive tag="kav_pri_vers_adm" service="gr_kav" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser serveur DMZ_pri a dialoguer avec serveur kav admin" ipsec="0" accept="0">
|
|
410
|
<source name="ip_srv_pri_antivirus"/>
|
|
411
|
<destination name="ip_srv_antivirus_adm"/>
|
|
412
|
</directive>
|
|
413
|
<directive tag="trend_control_pri" service="gr_trend" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="controle de TREND de la DMZ vers la zone ADMIN" ipsec="0" accept="0">
|
|
414
|
<source name="ip_srv_antivirus_dmz"/>
|
|
415
|
<destination name="admin"/>
|
|
416
|
</directive>
|
|
417
|
<directive tag="trend_pri_vers_adm" service="gr_trend" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="client TREND DMZ pub vers serveur ADMIN" ipsec="0" accept="0">
|
|
418
|
<source name="ip_srv_pri_antivirus"/>
|
|
419
|
<destination name="ip_srv_antivirus_adm"/>
|
|
420
|
</directive>
|
|
421
|
</montantes>
|
|
422
|
<descendantes default_policy="1">
|
|
423
|
</descendantes>
|
|
424
|
</flux>
|
|
425
|
<flux zoneA="bastion" zoneB="privdmz">
|
|
426
|
<montantes default_policy="0">
|
|
427
|
<directive tag="spipzwook_dmzpri" service="gr_ntp" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise Zwook a se synchroniser (NTP) sur l'amon" ipsec="0" accept="0">
|
|
428
|
<source name="ip_spipzwook_dmzpri"/>
|
|
429
|
<destination name="bastion"/>
|
|
430
|
</directive>
|
|
431
|
<directive service="echo-request" priority="12" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise ETH4 a répondre au ping depuis DMZ pri" ipsec="0" accept="0">
|
|
432
|
<source name="privdmz_restreint"/>
|
|
433
|
<destination name="bastion"/>
|
|
434
|
</directive>
|
|
435
|
</montantes>
|
|
436
|
<descendantes default_policy="1">
|
|
437
|
</descendantes>
|
|
438
|
</flux>
|
|
439
|
<flux zoneA="exterieur" zoneB="pubdmz">
|
|
440
|
<montantes default_policy="0">
|
|
441
|
<directive tag="serveur_web_CG13_Region" service="gr_www" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorisation d'acces au serveur WEB depuis l'exterieur (CG13_Region)" ipsec="0" accept="0">
|
|
442
|
<source name="exterieur"/>
|
|
443
|
<destination name="serveur_web"/>
|
|
444
|
</directive>
|
|
445
|
<directive tag="serveur_web_FAI" service="http" priority="2" action="8" attrs="17" nat_extr="serveur_web" nat_port="80" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT de l'autorisation d'accés au serveur WEB depuis l'exterieur (FAI)" ipsec="0" accept="0">
|
|
446
|
<source name="exterieur"/>
|
|
447
|
<destination name="ETH0_DMZPUB"/>
|
|
448
|
</directive>
|
|
449
|
<directive tag="serveur_absence_CG13_Region" service="absence_9000" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorisation d'acces au serveur absence sur port 9000 (CG13_Region)" ipsec="0" accept="0">
|
|
450
|
<source name="exterieur"/>
|
|
451
|
<destination name="srv_absence"/>
|
|
452
|
</directive>
|
|
453
|
<directive tag="serveur_absence_FAI" service="absence_9000" priority="4" action="8" attrs="17" nat_extr="srv_absence" nat_port="9000" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT pour acces au serveur absence en port 9000 (FAI)" ipsec="0" accept="0">
|
|
454
|
<source name="exterieur"/>
|
|
455
|
<destination name="ETH0_DMZPUB"/>
|
|
456
|
</directive>
|
|
457
|
<directive tag="pronote_dmz_CG13_Region" service="gr_pronote_ext" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise accès pronote en dmz pub port 8000 et 49300 (CG13_Region)" ipsec="0" accept="0">
|
|
458
|
<source name="exterieur"/>
|
|
459
|
<destination name="ip_pronote_dmzpub"/>
|
|
460
|
</directive>
|
|
461
|
<directive tag="pronote_dmz_FAI" service="pronote_49300" priority="6" action="8" attrs="17" nat_extr="ip_pronote_dmzpub" nat_port="49300" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 49300 de l'ext vers srv pronote pub (FAI)" ipsec="0" accept="0">
|
|
462
|
<source name="exterieur"/>
|
|
463
|
<destination name="ETH0_DMZPUB"/>
|
|
464
|
</directive>
|
|
465
|
<directive tag="pronote_dmz_FAI" service="pronote_8000" priority="7" action="8" attrs="17" nat_extr="ip_pronote_dmzpub" nat_port="8000" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 8000 de l'ext vers srv pronote pub (FAI)" ipsec="0" accept="0">
|
|
466
|
<source name="exterieur"/>
|
|
467
|
<destination name="ETH0_DMZPUB"/>
|
|
468
|
</directive>
|
|
469
|
<directive tag="edt_dmz_CG13_Region" service="EDT" priority="8" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise accès EDT en dmz pub port tcp 49500 (CG13_Region)" ipsec="0" accept="0">
|
|
470
|
<source name="exterieur"/>
|
|
471
|
<destination name="ip_edt_dmzpub"/>
|
|
472
|
</directive>
|
|
473
|
<directive tag="edt_dmz_FAI" service="EDT" priority="9" action="8" attrs="17" nat_extr="ip_edt_dmzpub" nat_port="49500" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT ports tcp 49500 de l'ext vers srv EDT pub (FAI)" ipsec="0" accept="0">
|
|
474
|
<source name="exterieur"/>
|
|
475
|
<destination name="ETH0_DMZPUB"/>
|
|
476
|
</directive>
|
|
477
|
<directive tag="zwook_dmzpub_CG13_Region" service="gr_zwook" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise ports 80, 9080,443 de l'ext vers zwook pub (CG13_Region)" ipsec="0" accept="0">
|
|
478
|
<source name="exterieur"/>
|
|
479
|
<destination name="ip_spipzwook_dmzpub"/>
|
|
480
|
</directive>
|
|
481
|
<directive tag="zwook_dmzpub_FAI" service="http" priority="11" action="8" attrs="17" nat_extr="ip_spipzwook_dmzpub" nat_port="80" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 80 de l'ext vers zwook pub (FAI)" ipsec="0" accept="0">
|
|
482
|
<source name="exterieur"/>
|
|
483
|
<destination name="ETH0_DMZPUB"/>
|
|
484
|
</directive>
|
|
485
|
<directive tag="zwook_dmzpub_FAI" service="zwook_9080" priority="12" action="8" attrs="17" nat_extr="ip_spipzwook_dmzpub" nat_port="9080" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 9080 de l'ext vers zwook pub (FAI)" ipsec="0" accept="0">
|
|
486
|
<source name="exterieur"/>
|
|
487
|
<destination name="ETH0_DMZPUB"/>
|
|
488
|
</directive>
|
|
489
|
<directive tag="zwook_dmzpub_FAI" service="https" priority="13" action="8" attrs="17" nat_extr="ip_spipzwook_dmzpub" nat_port="443" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 443 de l'ext vers zwook pub (FAI)" ipsec="0" accept="0">
|
|
490
|
<source name="exterieur"/>
|
|
491
|
<destination name="ETH0_DMZPUB"/>
|
|
492
|
</directive>
|
|
493
|
<directive tag="acces_vpn_dmzpub" service="tous" priority="14" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser acces depuis client VPN vers DMZ pub" ipsec="0" accept="0">
|
|
494
|
<source name="ip_source_acces_vpn_dmzpub"/>
|
|
495
|
<destination name="ip_acces_vpn_dmzpub"/>
|
|
496
|
</directive>
|
|
497
|
<directive tag="ssh_dmzpub_CG13_Region" service="ssh_exterieur" priority="15" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise accès SSH en dmz pub sur port 25000 (CG13_Region)" ipsec="0" accept="0">
|
|
498
|
<source name="exterieur"/>
|
|
499
|
<destination name="ssh_dmzpub"/>
|
|
500
|
</directive>
|
|
501
|
<directive tag="ssh_dmzpub_fai" service="ssh_exterieur" priority="16" action="8" attrs="17" nat_extr="ssh_dmzpub" nat_port="25000" src_inv="0" dest_inv="0" serv_inv="0" libelle="DNAT port 25000 pour SSH de l'ext vers srv en dmzpub (FAI)" ipsec="0" accept="0">
|
|
502
|
<source name="exterieur"/>
|
|
503
|
<destination name="ETH0_DMZPUB"/>
|
|
504
|
</directive>
|
|
505
|
</montantes>
|
|
506
|
<descendantes default_policy="1">
|
|
507
|
<directive tag="zwook_dmzpub_CG13_Region" service="tous" priority="5" action="16" attrs="17" nat_extr="ETH0_DMZPUB" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise tout zwook pub vers ext (CG13_Region)" ipsec="0" accept="0">
|
|
508
|
<source name="ip_spipzwook_dmzpub"/>
|
|
509
|
<destination name="exterieur"/>
|
|
510
|
</directive>
|
|
511
|
<directive tag="zwook_dmzpub_FAI" service="tous" priority="6" action="16" attrs="17" nat_extr="ETH0_DMZPUB" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise tout zwook vers exterieur (FAI)" ipsec="0" accept="0">
|
|
512
|
<source name="ip_spipzwook_dmzpub"/>
|
|
513
|
<destination name="exterieur"/>
|
|
514
|
</directive>
|
|
515
|
<directive tag="dmzpub_cas_ext" service="eole-sso" priority="7" action="16" attrs="17" nat_extr="ETH0_DMZPUB" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser les serveurs en DMZ publique en mode CAS à sortir sur le port eole-sso" ipsec="0" accept="0">
|
|
516
|
<source name="ip_srv_dmzpub_cas"/>
|
|
517
|
<destination name="exterieur"/>
|
|
518
|
</directive>
|
|
519
|
<directive service="tous" priority="8" action="1" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Blocage acces Internet depuis DMZ Pub" ipsec="0" accept="0">
|
|
520
|
<source name="pubdmz"/>
|
|
521
|
<destination name="exterieur"/>
|
|
522
|
</directive>
|
|
523
|
</descendantes>
|
|
524
|
</flux>
|
|
525
|
<flux zoneA="admin" zoneB="pubdmz">
|
|
526
|
<montantes default_policy="0">
|
|
527
|
<directive tag="kav_pub_vers_adm" service="gr_kav" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser serveur DMZ_pub a dialoguer avec serveur kav admin" ipsec="0" accept="0">
|
|
528
|
<source name="ip_srv_pub_antivirus"/>
|
|
529
|
<destination name="ip_srv_antivirus_adm"/>
|
|
530
|
</directive>
|
|
531
|
<directive tag="trend_pub_vers_adm" service="gr_trend" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser trend de la dmz pub vers l'admin" ipsec="0" accept="0">
|
|
532
|
<source name="ip_srv_pub_antivirus"/>
|
|
533
|
<destination name="ip_srv_antivirus_adm"/>
|
|
534
|
</directive>
|
|
535
|
</montantes>
|
|
536
|
<descendantes default_policy="1">
|
|
537
|
</descendantes>
|
|
538
|
</flux>
|
|
539
|
<flux zoneA="bastion" zoneB="pubdmz">
|
|
540
|
<montantes default_policy="0">
|
|
541
|
<directive tag="zwook_dmzpub_CG13_Region" service="gr_ntp" priority="12" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise Zwook a se synchroniser (NTP) sur l'amon - CG13_Region" ipsec="0" accept="0">
|
|
542
|
<source name="ip_spipzwook_dmzpub"/>
|
|
543
|
<destination name="bastion"/>
|
|
544
|
</directive>
|
|
545
|
<directive tag="zwook_dmzpub_FAI" service="gr_ntp" priority="13" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise Zwook a se synchroniser (NTP) sur l'amon - FAI" ipsec="0" accept="0">
|
|
546
|
<source name="ip_spipzwook_dmzpub"/>
|
|
547
|
<destination name="bastion"/>
|
|
548
|
</directive>
|
|
549
|
<directive service="echo-request" priority="14" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise ETH3 a repondre au ping depuis la zone DMZ pub" ipsec="0" accept="0">
|
|
550
|
<source name="pubdmz_restreint"/>
|
|
551
|
<destination name="bastion"/>
|
|
552
|
</directive>
|
|
553
|
</montantes>
|
|
554
|
<descendantes default_policy="1">
|
|
555
|
</descendantes>
|
|
556
|
</flux>
|
|
557
|
<flux zoneA="pedago" zoneB="privdmz">
|
|
558
|
<montantes default_policy="0">
|
|
559
|
<directive tag="kav_pri_vers_ped" service="gr_kav" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser serveur DMZ_pri a dialoguer avec serveur kav peda" ipsec="0" accept="0">
|
|
560
|
<source name="ip_srv_pri_antivirus"/>
|
|
561
|
<destination name="ip_srv_antivirus"/>
|
|
562
|
</directive>
|
|
563
|
<directive tag="spipzwook_dmzpri" service="gr_ldap" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise ldap 389 du zwook DMZ privé vers peda" ipsec="0" accept="0">
|
|
564
|
<source name="ip_spipzwook_dmzpri"/>
|
|
565
|
<destination name="pedago"/>
|
|
566
|
</directive>
|
|
567
|
<directive tag="kav_control_pri" service="gr_kav_control" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Kaspersky controle et WakeOnLan des clients peda à partir du server Kav en DMZpri" ipsec="0" accept="0">
|
|
568
|
<source name="ip_srv_antivirus_dmz"/>
|
|
569
|
<destination name="pedago"/>
|
|
570
|
</directive>
|
|
571
|
<directive tag="trend_pri_vers_ped" service="gr_trend" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser client trend de dmz prive vers peda" ipsec="0" accept="0">
|
|
572
|
<source name="ip_srv_pri_antivirus"/>
|
|
573
|
<destination name="ip_srv_antivirus"/>
|
|
574
|
</directive>
|
|
575
|
<directive tag="trend_control_pri" service="gr_trend" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser le controle de TREND de la DMZ pub vers le Peda" ipsec="0" accept="0">
|
|
576
|
<source name="ip_srv_antivirus_dmz"/>
|
|
577
|
<destination name="pedago"/>
|
|
578
|
</directive>
|
|
579
|
<directive tag="dmzpri_cas" service="eole-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser eole-sso depuis les serveurs en DMZ privée en mode CAS vers ENT péda" ipsec="0" accept="1">
|
|
580
|
<source name="ip_srv_dmzpri_cas"/>
|
|
581
|
<destination name="ip_scribe_peda"/>
|
|
582
|
</directive>
|
|
583
|
</montantes>
|
|
584
|
<descendantes default_policy="1">
|
|
585
|
<directive tag="Peda_NASpri" service="tous" priority="1" action="1" attrs="17" src_inv="1" dest_inv="0" serv_inv="0" libelle="Interdiction a tout sauf srv pedago vers NAS" ipsec="0" accept="0">
|
|
586
|
<source name="ip_sauv_nas"/>
|
|
587
|
<destination name="ip_nas"/>
|
|
588
|
</directive>
|
|
589
|
</descendantes>
|
|
590
|
</flux>
|
|
591
|
<flux zoneA="pubdmz" zoneB="pedago">
|
|
592
|
<montantes default_policy="0">
|
|
593
|
<directive tag="kav_pub_vers_ped" service="gr_kav" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise serveurs de DMZ Pub a se connecter a KAV sur pedago" ipsec="0" accept="0">
|
|
594
|
<source name="ip_srv_pub_antivirus"/>
|
|
595
|
<destination name="ip_srv_antivirus"/>
|
|
596
|
</directive>
|
|
597
|
<directive tag="zwook_dmzpub_CG13_Region" service="gr_ldap" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise ldap 389 du zwook vers peda (CG13_Region)" ipsec="0" accept="0">
|
|
598
|
<source name="ip_spipzwook_dmzpub"/>
|
|
599
|
<destination name="pedago"/>
|
|
600
|
</directive>
|
|
601
|
<directive tag="zwook_dmzpub_CG13_Region" service="dns" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise dns 53 du srv zwook pub vers peda (CG13_Region)" ipsec="0" accept="0">
|
|
602
|
<source name="ip_spipzwook_dmzpub"/>
|
|
603
|
<destination name="pedago"/>
|
|
604
|
</directive>
|
|
605
|
<directive tag="zwook_dmzpub_FAI" service="gr_ldap" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise LDAP 389 zwook pub vers peda (FAI)" ipsec="0" accept="0">
|
|
606
|
<source name="ip_spipzwook_dmzpub"/>
|
|
607
|
<destination name="pedago"/>
|
|
608
|
</directive>
|
|
609
|
<directive tag="zwook_dmzpub_FAI" service="dns" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise dns 53 zwook pub vers peda (FAI)" ipsec="0" accept="0">
|
|
610
|
<source name="ip_spipzwook_dmzpub"/>
|
|
611
|
<destination name="pedago"/>
|
|
612
|
</directive>
|
|
613
|
<directive tag="pronote_peda_CG13_Region" service="pronote_49300" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise le port 49300 entre pub(relais-net) vers peda (serveur) (CG13_Region)" ipsec="0" accept="0">
|
|
614
|
<source name="ip_pronote_dmzpub"/>
|
|
615
|
<destination name="ip_pronote_peda"/>
|
|
616
|
</directive>
|
|
617
|
<directive tag="pronote_peda_FAI" service="pronote_49300" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser port 49300 de pub (relais-net) vers peda (srv pronote) (FAI)" ipsec="0" accept="0">
|
|
618
|
<source name="ip_pronote_dmzpub"/>
|
|
619
|
<destination name="ip_pronote_peda"/>
|
|
620
|
</directive>
|
|
621
|
<directive tag="edt_peda_CG13_Region" service="EDT" priority="8" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise le port 49500 entre pub(EDT relais) vers peda (serveur EDT) (CG13_Region)" ipsec="0" accept="0">
|
|
622
|
<source name="ip_edt_dmzpub"/>
|
|
623
|
<destination name="ip_edt_peda"/>
|
|
624
|
</directive>
|
|
625
|
<directive tag="edt_peda_FAI" service="EDT" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser port 49500 de pub (relais-net) vers peda (srv pronote) (FAI)" ipsec="0" accept="0">
|
|
626
|
<source name="ip_edt_dmzpub"/>
|
|
627
|
<destination name="ip_edt_peda"/>
|
|
628
|
</directive>
|
|
629
|
<directive tag="trend_pub_vers_ped" service="gr_trend" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser trend depuis publique vers prive" ipsec="0" accept="0">
|
|
630
|
<source name="ip_srv_pub_antivirus"/>
|
|
631
|
<destination name="ip_srv_antivirus"/>
|
|
632
|
</directive>
|
|
633
|
<directive tag="dmzpub_cas_peda" service="eole-sso" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser eole-sso depuis les serveurs en DMZ publique en mode CAS vers ENT péda" ipsec="0" accept="1">
|
|
634
|
<source name="ip_srv_dmzpub_cas"/>
|
|
635
|
<destination name="ip_scribe_peda"/>
|
|
636
|
</directive>
|
|
637
|
</montantes>
|
|
638
|
<descendantes default_policy="1">
|
|
639
|
</descendantes>
|
|
640
|
</flux>
|
|
641
|
<flux zoneA="pubdmz" zoneB="privdmz">
|
|
642
|
<montantes default_policy="0">
|
|
643
|
<directive tag="pronote_dmzpri_CG13_Region" service="pronote_49300" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise le port 49300 entre pub(relais-net) vers pri (serveur) (CG13_Region)" ipsec="0" accept="0">
|
|
644
|
<source name="ip_pronote_dmzpub"/>
|
|
645
|
<destination name="ip_pronote_dmzpri"/>
|
|
646
|
</directive>
|
|
647
|
<directive tag="pronote_dmzpri_FAI" service="pronote_49300" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser port 49300 de pub (relais-net) vers pri (srv pronote) (FAI)" ipsec="0" accept="0">
|
|
648
|
<source name="ip_pronote_dmzpub"/>
|
|
649
|
<destination name="ip_pronote_dmzpri"/>
|
|
650
|
</directive>
|
|
651
|
<directive tag="kav_pub_vers_pri" service="gr_kav" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise serveurs de DMZ Pub a se connecter a KAV sur DMZ Pri" ipsec="0" accept="0">
|
|
652
|
<source name="ip_srv_pub_antivirus"/>
|
|
653
|
<destination name="ip_srv_antivirus_dmz"/>
|
|
654
|
</directive>
|
|
655
|
<directive tag="edt_dmzpri_CG13_Region" service="EDT" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorise le port 49500 entre pub(EDT relais) vers pri (serveur EDT) (CG13_Region)" ipsec="0" accept="0">
|
|
656
|
<source name="ip_edt_dmzpub"/>
|
|
657
|
<destination name="ip_edt_dmzpri"/>
|
|
658
|
</directive>
|
|
659
|
<directive tag="edt_dmzpri_FAI" service="EDT" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser port 49500 de pub (EDT relais) vers pri (srv EDT) (FAI)" ipsec="0" accept="0">
|
|
660
|
<source name="ip_edt_dmzpub"/>
|
|
661
|
<destination name="ip_edt_dmzpri"/>
|
|
662
|
</directive>
|
|
663
|
<directive tag="trend_pub_vers_pri" service="gr_trend" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser dmz pub vers le serveur trend en dmz prive" ipsec="0" accept="0">
|
|
664
|
<source name="ip_srv_pub_antivirus"/>
|
|
665
|
<destination name="ip_srv_antivirus_dmz"/>
|
|
666
|
</directive>
|
|
667
|
<directive tag="dmzpub_cas_pri" service="eole-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser eole-sso depuis les serveurs en DMZ publique en mode CAS vers ENT dmz privée" ipsec="0" accept="1">
|
|
668
|
<source name="ip_srv_dmzpub_cas"/>
|
|
669
|
<destination name="ip_scribe_pri"/>
|
|
670
|
</directive>
|
|
671
|
</montantes>
|
|
672
|
<descendantes default_policy="1">
|
|
673
|
</descendantes>
|
|
674
|
</flux>
|
|
675
|
</flux-list>
|
|
676
|
</firewall>
|