3.3. Services
3.3.1. Overview
A Service object is a reference to a specific IP protocol with associated parameters. A service
definition is usually based on one of the major transport protocols such as TCP or UDP which is
associated with a specific source and/or destination port number(s). For example, the HTTP
service is defined as using the TCP protocol with the associated destination port 80 and any
source port.
However, service objects are not restricted to just the TCP or UDP protocols. They can be used to
encompass ICMP messages as well as a user-definable IP protocol.
A Service is Passive
Services are passive NetDefendOS objects in that they do not themselves carry out any action in
the configuration. Instead, service objects must be associated with the security policies defined
by various NetDefendOS rule sets and then act as a filter to apply those rules only to a specific
type of traffic.
For example, an IP Rule or IP Policy in a NetDefendOS IP rule set has a service object associated
with it as a filtering parameter to decide whether or not to allow a specific type of traffic to
traverse the NetDefend Firewall. Inclusion in either IP rules or policies is one the most important
usage of service objects and it is also how ALGs become associated with IP rules since an ALG is
associated with a service and not directly with an IP rule.
For IP rules, the service is how an ALG becomes associated with an IP rule. An ALG is associated
with a service and not directly with an IP rule. For more information on how service objects are
used with IP rules, see Section 3.6, “IP Rules and IP Policies”.
For IP policies, there is no reason to use an ALG at all since all the ALG options become available
when the service is associated with the IP policy provided the Protocol property of the service
has been set.
Predefined Services
A large number of service objects are predefined in NetDefendOS. These include common
services such as http and ftp.
Predefined services can be used and also modified just like custom, user defined services.
However, it is recommended to not make any changes to predefined services and instead create
custom services with the desired characteristics.
Custom service creation is discussed in detail later in Section 3.3.2, “Creating Custom Services”.
Changes to Predefined Services in Version 11.01 and Later
With NetDefendOS version 11.01 and later, changes were made to the predefined Service objects.
In 11.01 and later the following predefined services and the associated predefined ALGs were
removed from a new NetDefendOS installation:
• http (ALG only removed)
• http-outbound (Service and ALG removed)
• ftp-inbound (Service and ALG removed)
• ftp-outbound (Service and ALG removed)
• ftp-internal (Service and ALG removed)
Chapter 3: Fundamentals
165
To Next Page
Loading...
