1. Closing SFSU border firewall Prepared by E.Rayz DoIT Network Services Coordinator February 14, 2012

2. Topics covered by this presentation CSU San Francisco Edge Network Design overview Firewall rules - how they work Best practices when closing the borders On-going support overview Q&A

3. CSU San Francisco Edge Network Design

4. Firewall rules - how they work

5. - VPN software available for faculty and staff, also some sponsored contractors -systems administrators are encouraged to use sftp, ssh, and https vs other unencrypted protocols - systems administrators need to use static ip addresses for servers, and register those ip addresses in dns via e-mail to dns@otrs.sfsu.edu - requests for justified exceptions will follow an established process and change control procedure, and may take approximately 1 week Best practices when closing the borders

6. On-going support for exemptions requests The completed “Border FW inbound Port exemption” form should be emailed by authorized Change Control contact to helpdesk@sfsu.edu with a CC to fw-request@sfsu.edu by Thursday, March 1 st, 2012. The border firewall closure is scheduled for Thursday, March 15 th, 2012helpdesk@sfsu.edufw-request@sfsu.edu You will be contacted within 3 business days regarding your request The following unencrypted and shell access protocols will not be allowed through the firewall except where there is a business justification (e.g. anonymous FTP). End users and administrators are encouraged to use campus VPN for systems needing access via any of the following: Telnet FTP Secure Shell Remote Desktop

7. NameJonSmith DepartmentEducation BuildingBurk Hall Room #999 Phone87777 Email jsmith@sfsu.edu ApplicationActionProtocolSource IP Source Port Destinati on IP Destin ation Port Operating System (Drop- Down Choices) Device (Drop- Down Choices) Reason for Exemption wwwALLOWTCPANY 130.212. 65.200 80MacOSServerWeb Server Border firewall inbound port exemption template example:

8. Q&A A comprehensive border firewall workshop is scheduled for February 20 th 10:30 a.m. – 12 noon, please stay tuned for details on location and full agenda