Outside the Firewall

If the CNA system is entirely outside of your firewall, the management port, which can provide access to the CNA system via such protocols as http, telnet, snmp and ssh, will be exposed. (Individual protocols can be enabled or disabled by user configuration.)

See Figure 2.

Figure 2:  CNA system entirely outside the firewall

Security measures available to you include:

• access lists on the CNA system as well as edge router interfaces
• secure shell (ssh) instead of telnet
• Secure Sockets Layer (SSL)
• authentication (local, RADIUS and TACACS+)

See Chapter 3: Security in the CNA Basic Monitoring Guide.