The Network Security Lab team installs the Candidate Firewall Product according to the provided documentation. This section of the report documents the initial security posture of the Candidate Firewall Product. The Network Security Lab team verified that the enabled ports were indeed listening for requests and that the services bound to those ports operated as expected. The table below contains a description of the services determined to be listening on the product. The ports listed in the table above are used for remote administration of the firewall.
All inbound traffic is disabled by default.
Required Services Security Policy Explanation of this section The Firewall Product Certification Criteria version 3.0a mandates that only a select group of services be enabled in the firewall security policy rule base. The security policy rule base permits outbound Telnet, FTP, HTTP, SSL, SMTP and DNS service requests. Except for Telnet, the security policy rule base permits those same services inbound. Further, if the firewall supports remote administration from an internal or external network host, it may be configured according to the vendor-supplied documentation to meet the criteria. However, if the vendor does not provide remote administration functionality, or the vendor provides the functionality, but the strength of authentication or encryption used is not sufficient to meet the criteria, remote administration will not be configured.