topic Managment interface - administrator access to GW in Firewall and Security Management

Managment interface - administrator access to GW

cir007 — Mon, 09 Oct 2023 13:14:14 GMT

Hello mates,

I'm looking for a way to create a "trusted clients" list to populate on full Gaia. Kinda like the "Administrator access" in SMB devices. I have FWs on cca 100 diffrent locations. Some od those locations don't have IT staff capable of other tasks than switching cable from one device to new one. So if SIC is successful than great but if not... Need a way to have acces to remote GWs regardless if policy is installed.

Re: Administrator access to GW

_Val_ — Mon, 09 Oct 2023 11:22:03 GMT

There is a way to allow WebUI/SSH connectivity to the GW from trusted IPs.

Go to Gaia WebUI, switch to Advanced view, then go to System Management / Host Access

Add clients that should be allowed to connect to the GW.

Re: Administrator access to GW

cir007 — Mon, 09 Oct 2023 11:26:47 GMT

Hey Val,

thank you for prompt replay. Tried this before postig my question, sadly it doesn't work. Meaning security policy is processed, before this list. As we can see from the picture, default is "Any"

Re: Administrator access to GW

_Val_ — Mon, 09 Oct 2023 11:59:20 GMT

Partially correct.

These rules define limited access through the"Management" interface only, regardless of the policy, if you do not disable the implied rules.

Check if you want to redefine internet facing IF as MANAGEMENT. Lab trials are highly recommended.

Re: Administrator access to GW

the_rock — Mon, 09 Oct 2023 12:09:24 GMT

What @_Val_ gave you is only thing Ima ware of as well. Otherwise, policy from the management would come into an effect.

Andy

Re: Administrator access to GW

cir007 — Mon, 09 Oct 2023 13:49:15 GMT

Hm, OK after some testing in lab I came to the following conclusion and questions:

- CP admin guides must provide more specific intention of the managment interface and its usage

-meaning GW uses allowed hosts table only when initial policy is loaded, after you install security policy, packet flow to GW is process via policy rules (that was my understaning of the usage of the specific table )

Regardnign impled rules- is there an implied rule to process the "allowed hosts" table first? If so could you point me in the right direction.

Check if you want to redefine internet facing IF as MANAGEMENT - to my understanding this sould be the case on all WAN only accesible GWs. OR is there any security limitations? After policy is installed and GW object is defined as destination in security policy, GW is accesible via all interfaces.

So I guess this solve my problem when connecting a new GW, after that if policy is in order access should work.