User manual CYBER OPERATIONS XACTA-ACL MANAGER GOVERNMENT 5.5

[. . . ] Please visit our website at www. xacta. com for up-to-date system recommendations, customer support, and software upgrades. Unauthorized reproduction of ACL Manager or any of its components is strictly prohibited and expressly forbidden. Any unauthorized reproduction will be in direct violation of international patent or copyright laws. Getting Help and Technical Support Documentation Conventions 1 1. 1 1. 2 1. 3 1. 4 1. 5 1. 6 1. 7 1. 8 1. 9 1. 10 1. 11 1. 12 2 2. 1 2. 2 2. 3 2. 4 2. 5 2. 6 3 Introduction 1 1 2 File Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Edit Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Device Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Access List Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Window Menu. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Help Menu. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Configuring a Global Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Add Router or Junction to Network Configuration . . . . . . . . . . . . . . . . . 4 Add a Child Router to the Router Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Edit a Router. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Delete a Router from the Router Pane. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Accessing the Log Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Access Control List (ACL) Basics 8 Create an Access Control List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Open an Existing Access List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Edit an Access List Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Delete an Access List Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Save an Access List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Simplifying Access Control Lists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Manipulating Access Control Lists (ACL) 12 3. 1 Merge Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3. 2 Deploy an ACL Using the Access List Interface . . . . . . . . . . . . . . . . . . 15 3. 3 Cutting and Pasting Access Control List Items . . . . . . . . . . . . . . . . . . . . . 15 3. 4 Rolling Back Access Control Lists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3. 5 Comparing Access Control Lists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Appendix A - List of Acronyms 18 Index 19 Getting Help and Technical Support Technical assistance is available for users of ACL Manager by contacting: 1300 Connecticut Ave NW Suite 1000 Washington, DC 20036 Phone: 202-466-8711 www. xacta. com Documentation Conventions The following general conventions and visual cues are used throughout this guide to help you identify various fields, buttons, commands, and operations used within ACL Manager. · Button names, menu options, items and commands that are to be typed into fields or at the command line are printed in boldface type; for example, "Click Remove to delete the file from the database. " File names and directories are shown in boldface courier font; for example /etc/rc. conf. · · Notes and cautions are enclosed in boxes as shown below. Notes call particular attention to a step or procedure that requires additional explanation. ! CAUTION Cautions call particular attention to a step or procedure that, if not strictly followed, could result in damage or destruction to the equipment or data file. 1 1 1. 1 Introduction File Menu Menu Item Log In Use to: Provide a username and password, along with an enable password. [. . . ] Specify source/target IP addresses and network source mask, and network target mask. Control returns to the ACL Manager user interface and appends the new entry to the list. 2. 2 Open an Existing Access List 1. Select Access List Editor if the Access List window is not already visible. The following window appears. 10 Figure 1. 7 - Open Access List 3. Control returns to the ACL Manager interface and displays the list. 2. 3 Edit an Access List Entry 1. Select Access List Editor if the Access List window is not already visible. Note that merging requires files or access lists to already be created and saved in a folder. For further information on creating or saving an access list, refer to sections on Creating and Saving Access Lists. The manner in which the merge function handles special cases is dependent upon the merge option(s) selected. The following window appears. Figure 1. 8 - Select Access List to Merge with Existing Access Control List 4. Select the file to be merged with the list from which you clicked the merge button. The following Merge Options window appears. Figure 1. 9 - Merge Options Window 7. Strictly mathematical merge If option i) is selected, then ACL Manager will try to automatically choose the best options for the merge. 13 If option ii) is selected, then more specific rules will be given priority and you will be presented with a set of four additional options to choose how conflicts will be resolved. Overlapping conflicting rules should be resolved with the more restrictive rule. Overlapping conflicting rules should be resolved with the less restrictive rule. If option a) is selected, then rules in the original list will take precedence over rules in the second input list when there is a conflict. If option b) is selected, then rules in the second input list will take precedence, instead, over rules in the original list when there is a conflict. If option c) is selected, then the more restrictive rule will take precedence when there is a conflict between the two input lists, regardless of which list it originates from. If option d) is selected, then the less restrictive rule will take precedence when there is a conflict, regardless of the list it originates from. If option iii) is selected, then the merge will be done as a strictly mathematical set operation. An additional choice between the following two options will be presented: a. Conflicts should be resolved with the less restrictive rule. If option a) is selected, then the resulting access list will only permit traffic permitted by each of the two input lists. If option b) is selected, then the resulting access list will only deny traffic denied by each of the two input lists. [. . . ] When you create a device node in the list, you can override the global login for each individual device if they do not support TACACS or other authentication. In every other case, it uses the operator's credentials for router access. How do I control multiple interfaces on the same router with separate access lists?In order to control multiple interfaces on a router with separate access lists, you would create a node for each interface you want to control and just specify which interface(s) when you create the node. [. . . ]