2006-421 - Laserfiche WebLink

Home Browse Search

• Providing some additional security by limiting internal address exposure to the global Internet (specifically, user PCs will not be reachable inbound from the Internet, only statically NATed hosts will be reachable from the Internet). • Allowing for addressing efficiencies and, • Conserving IP addresses Two NAT Models are offered: • Static Address Translation - Customer may establish a many-to-one mapping between local and global address, or Customer may configure Static address translations to the port level, using remaining IP addresses for other translations. In this scenario, only the customers Hosts are mapped and "reachable" from the Internet; the Hosts then communicate with the customer's internal network (PCs). • Port Address Translation (PAT) - (also known as "overload") Customer may map several internal addresses to one. When using PAT, traffic will attempt to engage the original source port; if the source port is fully utilized, PAT will cause the traffic to find the first available port. (same as above) Customers will be limited to the number of IP address on their LAN with NAT translation to a /24 block (254 usable addresses). A customer may request additional IP addresses with NAT translation. Note: The Network Address Translation feature is not supported for DIA Diversity Solutions. Cisco IDS NAT cannot be used with Hot Standby Routing Protocol (HSRP). In DIA Diversity Solutions, HSRP is used in the Customer Premises Equipment (CPE) to allow a fail-over to the secondary CPE router in the event the primary router fails. Packet Filtering With Packet Filtering, BellSouth provides an optional router filter service to all DIA customers. These router filters are configured on the termination router and are generally used to help prevent unwanted traffic from entering or leaving the customers private network. DIA IDS Firewall Dedicated Internet Access Firewall Service (DIA Firewall) is a security-specific offer providing new and eAsting "Port+Access+CPE" DIA Service customers an option to outsource managed security services for network protection and defense against attacks. Security is enabled through an advanced firewall engine with state-of-the-art security features including packet inspection, application-based filtering (conte)d-based access control), per user authentication and authorization, and real-time alerts. For Port+Access DIA customers, the DIA Firewall service is provided through the installation of a certified firewall platform at the customers premise(s) with remote configuration, management, monitoring, and maintenance from BellSouth's Security Operations Center (SOC). DIA Firewall includes: • Provisioning of a certified firewall platform • Installation and configuration (remote) of the firewall platform • 24X7 management and monitoring • Firewall administration and maintenance 24X7 help desk support • Outbound, Inbound/Outbound, a Inbound/Outbound with DMZ directional traffic protection • Implementation of firewall rules-base changes (per level of service) requested by customer There are three DIA Firewall levels of service available to customers. 1 . Basic Firewall a. Internet protection b. Supports Fractional T1 up to DS3 access speeds C. Chace of 0, 1 , 2, 3, 4, or 5 rule-base change requests per year 2. Advanced Firewall a. Bi-Directional protection b. Supports Fractional T1 up to DS3 access speeds C. Choice of 3, 6, 9, 12, 15, or 25 rule-base change requests per year (customer rule-base change requests greater than 25 requires an SRF) d. Choice of up to 10 IF Addresses assigned for hosted servers per year (customer requests for IP Addresses greater than 10 requires an SRF) The diagram below represents the conceptual overview for Basic and Advanced DIA Firewall: u Transport BRIG Global Service Internet Customer Premises BellSouth Equipment Managed Facility 3. Premium Firewall a. Bi-Directional protection, with DMZ b. Supports Fractional T1 up to DS3 access speeds C. Choice of 3, 6, 9, 12, 15, or 25 rule-base change requests per year (customer rule-base change requests greater than 25 requires an SRF) d. Choice of up to 10 IP Addresses assigned for hosted servers per year (customer requests for IP Addresses greater than 10 requires an SRF) CONFIDENTIAL/PROPRIETARY — NOT FOR DISCLOSURE WITHOUT WRITTEN PERMISSION Version: 08/2005 Page 12 of 19 Created On : June 28, 2006 CCP-12457