|
|
|
The CNA system implements an implicitly defined access list on each interface, and it implicitly adds a final deny rule to the end of all access lists of any origin. This final rule is the equivalent of entering the following deny command in the configuration:
deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
This denies any IP access to the interface through any port that has not been specifically allowed by a previous rule. This means that, when you apply an access list of your own to any interface, you must explicitly re-enable access to all of the ports required on that interface by the CNA system. Each of the modules that require an eth0 interface (all except the reporting module) requires its own unique set of permissions.
NOTE: The implicit deny command will not appear in the configuration. If you want a visual reminder that it is there, you can explicitly add the command to the end of your access lists. If you then later remove it, however, you should remember that it is still applied by the operating system by default--removing it from the configuration will not change that.
|
|
|