3Com 3CRFW102 User Manual

12 CHAPTER 2: INSTALLING THE FIREWALL CLIENTThe 3Com Embedded Firewall Policy Server and Management Console (soldseparately) is used by the security administrator to define and control the securitypolicies that are executed by the server, desktop, and notebook firewalls. Thiscentral management console also provides security logging capabilities, givingadministrators the ability to view logs and perform troubleshooting.The 3Com Embedded Firewall Client Devices (available in desktop and server PCI,as well as laptop-based Cardbus) receive security policies from the policy server.This security processor on each of these firewalls examines the traffic passingthrough the device and blocks traffic that falls outside of the security policy.Firewall PC Card The 3Com Embedded Firewall solution applies security policy enforcementcapabilities to all traffic transmitted from and received by an individual laptop,desktop, or server.The Firewall Client Device provides transparent packet filtering in accordance withthe rules that are setup by a security administrator. The rules are defined through acentralized management console and are communicated to the firewall clientdevices via the policy server.Like traditional perimeter firewalls, the 3Com Embedded Firewall solution iscapable of classifying and acting upon packets based on the following criteria:• Source IP Address• Source IP Mask• Source Port• Destination IP Address• Destination IP Mask• Destination Port• IP Protocol (TCP, UDP, etc.)• Direction (Inbound, Outbound, both)Once the traffic has been classified, actions that may be taken on the packet are:• Allow• Allow and Audit• Deny• Deny and AuditOptional ControlHeadersThe 3Com Firewall PC Card includes optional controls for the following:No Sniffing--Prevents the Firewall Client Device from sniffing traffic addressed toother devices on your network.No Spoofing--Prevents the Firewall Client Device from sending packets on thenetwork with forged source IP addresses.Non-IP Traffic--Denies Non-IP Traffic such as IPX or NetBEUI.