|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
|
|
3
|
<firewall name="/usr/share/era/modeles/3zones-ssredirhttps.xml" netbios="1" qos="0" version="2.0">
|
|
4
|
<zones>
|
|
5
|
<zone name="exterieur" level="10" ip="%%adresse_ip_eth0" network="%%adresse_network_eth0" netmask="%%adresse_netmask_eth0" interface="%%interface_gw"/>
|
|
6
|
<zone name="pedago" level="40" ip="%%adresse_ip_eth2" network="%%adresse_network_eth2" netmask="%%adresse_netmask_eth2" interface="eth2"/>
|
|
7
|
<zone name="admin" level="50" ip="%%adresse_ip_eth1" network="%%adresse_network_eth1" netmask="%%adresse_netmask_eth1" interface="eth1"/>
|
|
8
|
<zone name="bastion" level="100" ip="127.0.0.1" network="0.0.0.0" netmask="255.255.255.255" interface="lo"/>
|
|
9
|
</zones>
|
|
10
|
<services>
|
|
11
|
<service name="8500" protocol="tcp" ports="8500" id="11" libelle="service 8500" />
|
|
12
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" />
|
|
13
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" />
|
|
14
|
<service name="imap4-ssl" protocol="tcp" ports="585" id="23" libelle="service imap4-ssl" />
|
|
15
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" />
|
|
16
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" />
|
|
17
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" />
|
|
18
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" />
|
|
19
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" />
|
|
20
|
<service name="echo-reply" protocol="ICMP" ports="0" id="echo-reply" libelle="règle icmp echo-reply" />
|
|
21
|
<service name="nuauth" protocol="tcp" ports="4129" id="43" libelle="Serveur d'authentification NuFw" />
|
|
22
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
23
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" />
|
|
24
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" />
|
|
25
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="web sécurisé" />
|
|
26
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" />
|
|
27
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" />
|
|
28
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" />
|
|
29
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" />
|
|
30
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" />
|
|
31
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" />
|
|
32
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" />
|
|
33
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
34
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
35
|
<service name="eole-sso" protocol="tcp" ports="8443" id="45" libelle="Service Eole SSO" />
|
|
36
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" />
|
|
37
|
<service name="sso" protocol="tcp" ports="8443" id="44" libelle="serveur d'auth" />
|
|
38
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" />
|
|
39
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="41" libelle="Acces web aux agents Zephir" />
|
|
40
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" />
|
|
41
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" />
|
|
42
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
43
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" />
|
|
44
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" />
|
|
45
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" />
|
|
46
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" />
|
|
47
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
48
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" />
|
|
49
|
<service name="webmin" protocol="tcp" ports="10000" id="9" libelle="appliquation web d'administration" />
|
|
50
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
51
|
<service name="tous" protocol="TOUT" ports="0" id="tout" libelle="tous les services" />
|
|
52
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" />
|
|
53
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
54
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
55
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" />
|
|
56
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" />
|
|
57
|
<groupe id="gr_irc" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
58
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" />
|
|
59
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" />
|
|
60
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" />
|
|
61
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" />
|
|
62
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" />
|
|
63
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" />
|
|
64
|
</groupe>
|
|
65
|
<groupe id="scribe-pedago" libelle="service scribe dmz vers peda">
|
|
66
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
67
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
68
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
69
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" />
|
|
70
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
71
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
72
|
</groupe>
|
|
73
|
<groupe id="gr_ftp" libelle="">
|
|
74
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
75
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" />
|
|
76
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" />
|
|
77
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" />
|
|
78
|
</groupe>
|
|
79
|
<groupe id="admin_amon" libelle="Port autorise pour l'administration distante d'Amon (ssh, ead, agents zephir)">
|
|
80
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="41" libelle="Acces web aux agents Zephir" />
|
|
81
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
82
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
83
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" />
|
|
84
|
<service name="eole-sso" protocol="tcp" ports="8443" id="45" libelle="Service Eole SSO" />
|
|
85
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" />
|
|
86
|
</groupe>
|
|
87
|
<groupe id="gr_messagerie" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
88
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" />
|
|
89
|
<service name="imap4-ssl" protocol="tcp" ports="585" id="23" libelle="service imap4-ssl" />
|
|
90
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" />
|
|
91
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" />
|
|
92
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" />
|
|
93
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" />
|
|
94
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" />
|
|
95
|
</groupe>
|
|
96
|
<groupe id="gr_forum" libelle="interdire l'utilisation des forums">
|
|
97
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" />
|
|
98
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" />
|
|
99
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" />
|
|
100
|
</groupe>
|
|
101
|
<groupe id="gr_restreint" libelle="on ferme tout sauf l'utilisation du web par le proxy">
|
|
102
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" />
|
|
103
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" />
|
|
104
|
</groupe>
|
|
105
|
<groupe id="scribe_ext" libelle="services extranet scribe ">
|
|
106
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
107
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="web sécurisé" />
|
|
108
|
</groupe>
|
|
109
|
<groupe id="gr_ead" libelle="eole admin">
|
|
110
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
111
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
112
|
</groupe>
|
|
113
|
<groupe id="samba" libelle="samba proto">
|
|
114
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
115
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
116
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
117
|
</groupe>
|
|
118
|
<groupe id="dns" libelle="dns tcp et udp">
|
|
119
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" />
|
|
120
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" />
|
|
121
|
</groupe>
|
|
122
|
<groupe id="vnc" libelle="vnc">
|
|
123
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
124
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
125
|
</groupe>
|
|
126
|
<groupe id="gr_redirection" libelle="Protocoles a rediriger vers le proxy">
|
|
127
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" />
|
|
128
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" />
|
|
129
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" />
|
|
130
|
</groupe>
|
|
131
|
</services>
|
|
132
|
<qosclasses upload="" download="">
|
|
133
|
</qosclasses>
|
|
134
|
<extremites>
|
|
135
|
<extremite zone="pedago" name="tout_pedago" libelle="Zone entiere pedago" netmask="0.0.0.0" subnet="1">
|
|
136
|
<ip address="0.0.0.0"/>
|
|
137
|
</extremite>
|
|
138
|
<extremite zone="admin" name="admin_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth1" subnet="1">
|
|
139
|
<ip address="%%adresse_network_eth1"/>
|
|
140
|
</extremite>
|
|
141
|
<extremite zone="exterieur" name="exterieur" libelle="entire zone" netmask="0.0.0.0" subnet="1">
|
|
142
|
<ip address="0.0.0.0"/>
|
|
143
|
</extremite>
|
|
144
|
<extremite zone="admin" name="admin" libelle="entire zone" netmask="%%adresse_netmask_eth1" subnet="1">
|
|
145
|
<ip address="%%adresse_ip_eth1"/>
|
|
146
|
</extremite>
|
|
147
|
<extremite zone="exterieur" name="exterieur_restreint" libelle="zone restreinte exterieur" netmask="%%adresse_netmask_eth0" subnet="1">
|
|
148
|
<ip address="%%adresse_network_eth0"/>
|
|
149
|
</extremite>
|
|
150
|
<extremite zone="pedago" name="pedago_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth2" subnet="1">
|
|
151
|
<ip address="%%adresse_network_eth2"/>
|
|
152
|
</extremite>
|
|
153
|
<extremite zone="pedago" name="pedago" libelle="entire zone" netmask="%%adresse_netmask_eth2" subnet="1">
|
|
154
|
<ip address="%%adresse_ip_eth2"/>
|
|
155
|
</extremite>
|
|
156
|
<extremite zone="admin" name="tout_admin" libelle="zone entiere" netmask="0.0.0.0" subnet="1">
|
|
157
|
<ip address="0.0.0.0"/>
|
|
158
|
</extremite>
|
|
159
|
<extremite zone="exterieur" name="WhiteListeHTTPS" libelle="Liste blanche de serveur HTTPS" netmask="255.255.255.255" subnet="0">
|
|
160
|
<ip address="%%fw_httpsbypass_ip"/>
|
|
161
|
</extremite>
|
|
162
|
<extremite zone="bastion" name="bastion" libelle="entire zone" netmask="255.255.255.255" subnet="1">
|
|
163
|
<ip address="127.0.0.1"/>
|
|
164
|
</extremite>
|
|
165
|
<extremite zone="admin" name="admin_admin" libelle="reseau autorise a administrer depuis le reseau administratif" netmask="%%netmask_ssh_eth1" subnet="1">
|
|
166
|
<ip address="%%ip_ssh_eth1"/>
|
|
167
|
</extremite>
|
|
168
|
<extremite zone="exterieur" name="admin_exterieur" libelle="reseau autorise a administrer depuis l'exterieur" netmask="%%netmask_ssh_eth0" subnet="1">
|
|
169
|
<ip address="%%ip_ssh_eth0"/>
|
|
170
|
</extremite>
|
|
171
|
<extremite zone="exterieur" name="exterieur_bastion" libelle="l'ip du bastion" netmask="255.255.255.255" subnet="0">
|
|
172
|
<ip address="%%adresse_ip_eth0"/>
|
|
173
|
</extremite>
|
|
174
|
<extremite zone="pedago" name="admin_pedago" libelle="reseau autorise a administrer depuis le reseau pedagogique" netmask="%%netmask_ssh_eth2" subnet="1">
|
|
175
|
<ip address="%%ip_ssh_eth2"/>
|
|
176
|
</extremite>
|
|
177
|
</extremites>
|
|
178
|
<ranges>
|
|
179
|
</ranges>
|
|
180
|
<user_groups>
|
|
181
|
<user_group name="non identifiés" id="253"/>
|
|
182
|
<user_group name="tous identifiés" id="513"/>
|
|
183
|
<user_group name="professeurs" id="10001"/>
|
|
184
|
<user_group name="élèves" id="10002"/>
|
|
185
|
</user_groups>
|
|
186
|
<applications>
|
|
187
|
</applications>
|
|
188
|
<flux-list>
|
|
189
|
<flux zoneA="exterieur" zoneB="bastion">
|
|
190
|
<montantes default_policy="0">
|
|
191
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration Amon exterieure" >
|
|
192
|
<source name="admin_exterieur"/>
|
|
193
|
<destination name="bastion"/>
|
|
194
|
</directive>
|
|
195
|
<directive service="sso" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
196
|
<source name="exterieur"/>
|
|
197
|
<destination name="bastion"/>
|
|
198
|
</directive>
|
|
199
|
</montantes>
|
|
200
|
<descendantes default_policy="1">
|
|
201
|
</descendantes>
|
|
202
|
</flux>
|
|
203
|
<flux zoneA="exterieur" zoneB="pedago">
|
|
204
|
<montantes default_policy="0">
|
|
205
|
</montantes>
|
|
206
|
<descendantes default_policy="1">
|
|
207
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
208
|
<source name="pedago_restreint"/>
|
|
209
|
<destination name="exterieur"/>
|
|
210
|
</directive>
|
|
211
|
<directive tag="Interdiction des forums" service="gr_forum" priority="2" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de news, forums ..." >
|
|
212
|
<source name="pedago"/>
|
|
213
|
<destination name="exterieur"/>
|
|
214
|
</directive>
|
|
215
|
<directive tag="Interdire les connexions FTP" service="gr_ftp" priority="3" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="Interdire les connexions FTP" >
|
|
216
|
<source name="pedago"/>
|
|
217
|
<destination name="exterieur"/>
|
|
218
|
</directive>
|
|
219
|
<directive tag="Interdire l'utilisation des dialogues en direct" service="gr_irc" priority="4" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de discussion en ligne (irc ...)" >
|
|
220
|
<source name="pedago"/>
|
|
221
|
<destination name="exterieur"/>
|
|
222
|
</directive>
|
|
223
|
<directive tag="Interdiction des protocoles de messagerie" service="gr_messagerie" priority="5" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de messagerie (pop, imap ...)" >
|
|
224
|
<source name="pedago"/>
|
|
225
|
<destination name="exterieur"/>
|
|
226
|
</directive>
|
|
227
|
<directive tag="Internet restreint" service="gr_restreint" priority="6" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : tout interdire (sauf le web via le proxy)" >
|
|
228
|
<source name="pedago"/>
|
|
229
|
<destination name="exterieur"/>
|
|
230
|
</directive>
|
|
231
|
<directive service="gr_redirection" priority="7" action="4" attrs="0" nat_port="3128" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
232
|
<source name="pedago"/>
|
|
233
|
<destination name="exterieur"/>
|
|
234
|
</directive>
|
|
235
|
</descendantes>
|
|
236
|
</flux>
|
|
237
|
<flux zoneA="bastion" zoneB="pedago">
|
|
238
|
<montantes default_policy="0">
|
|
239
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser l'administration d'Amon depuis le reseau pedagogique" >
|
|
240
|
<source name="admin_pedago"/>
|
|
241
|
<destination name="bastion"/>
|
|
242
|
</directive>
|
|
243
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
244
|
<source name="pedago"/>
|
|
245
|
<destination name="bastion"/>
|
|
246
|
</directive>
|
|
247
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
248
|
<source name="pedago"/>
|
|
249
|
<destination name="bastion"/>
|
|
250
|
</directive>
|
|
251
|
<directive tag="auth_nufw" service="nuauth" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser les connexions au port 4129 (NuAuth) depuis pedago" >
|
|
252
|
<source name="tout_pedago"/>
|
|
253
|
<destination name="bastion"/>
|
|
254
|
</directive>
|
|
255
|
<directive service="sso" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
256
|
<source name="pedago"/>
|
|
257
|
<destination name="bastion"/>
|
|
258
|
</directive>
|
|
259
|
</montantes>
|
|
260
|
<descendantes default_policy="1">
|
|
261
|
</descendantes>
|
|
262
|
</flux>
|
|
263
|
<flux zoneA="exterieur" zoneB="admin">
|
|
264
|
<montantes default_policy="0">
|
|
265
|
</montantes>
|
|
266
|
<descendantes default_policy="1">
|
|
267
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
268
|
<source name="admin_restreint"/>
|
|
269
|
<destination name="exterieur"/>
|
|
270
|
</directive>
|
|
271
|
<directive service="gr_redirection" priority="2" action="4" attrs="0" nat_port="3128" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
272
|
<source name="admin"/>
|
|
273
|
<destination name="exterieur"/>
|
|
274
|
</directive>
|
|
275
|
</descendantes>
|
|
276
|
</flux>
|
|
277
|
<flux zoneA="pedago" zoneB="admin">
|
|
278
|
<montantes default_policy="0">
|
|
279
|
</montantes>
|
|
280
|
<descendantes default_policy="1">
|
|
281
|
</descendantes>
|
|
282
|
</flux>
|
|
283
|
<flux zoneA="bastion" zoneB="admin">
|
|
284
|
<montantes default_policy="0">
|
|
285
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
286
|
<source name="admin_admin"/>
|
|
287
|
<destination name="bastion"/>
|
|
288
|
</directive>
|
|
289
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
290
|
<source name="admin"/>
|
|
291
|
<destination name="bastion"/>
|
|
292
|
</directive>
|
|
293
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
294
|
<source name="admin"/>
|
|
295
|
<destination name="bastion"/>
|
|
296
|
</directive>
|
|
297
|
<directive tag="auth_nufw" service="nuauth" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser les connexions au port 4129 (NuAuth) depuis admin" >
|
|
298
|
<source name="tout_admin"/>
|
|
299
|
<destination name="bastion"/>
|
|
300
|
</directive>
|
|
301
|
<directive service="sso" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
302
|
<source name="admin"/>
|
|
303
|
<destination name="bastion"/>
|
|
304
|
</directive>
|
|
305
|
</montantes>
|
|
306
|
<descendantes default_policy="1">
|
|
307
|
</descendantes>
|
|
308
|
</flux>
|
|
309
|
</flux-list>
|
|
310
|
</firewall>
|