How do I specify IP addresses behind the firewall?

This article applies to:

• Firewall Suite
• WebTrends Firewall Suite 3.X
• WebTrends Firewall Suite 4.X

Question:

• How do I specify IP addresses behind the firewall?
• How do I better identify nonstandard protocol names to make them easier to analyze?

Symptoms:

• Firewall reports show results of all zeros.

Causes:

If you have not specified all IP ranges that are actually behind the firewall, you will only get the activity on incoming or outgoing reports that are for those IP ranges that you did specify in the profile.

Protocols not included in the Protocol in Log File list, and not associated with a Type of Traffic, are reported as "other". The activities of the miscellaneous, unassociated protocols in the "other" group are difficult to analyze.

Procedure:

The following procedures explain how to:

• Specify in your profile the IP ranges behind your firewall
• Better identify the unassociated protocol names, making them easier to analyze

To specify the IP addresses behind the firewall, follow these steps:

1. Edit the profile and select the IPs behind Firewall tab.
2. Enter the desired IP address ranges and click Add.
3. Use individual IP addresses, wildcards, and Classless Inter-Domain Routing (CIDR) to define IP ranges, for example:

Class A Subnet
255.*

Class B Subnet
255.255.*

Class C Subnet
255.255.255.*

Single Address in Classless Subnet
206.13.01.0/28
specifies a classless subnet in CIDR format where /28 indicates the number of bits used to identify the network

Classless Subnet Divided into Four Subnets
If the class C address space is divided into four classless subnets, you might specify them as follows"
203.13.01.0/26 specifies addresses 0 - 63
206.13.01.64/26 specifies addresses 64 - 127
206.13.01.128/26 specifies addresses 128 - 191
206.13.01.192/26 specifies addresses 192 - 255

Classless Subnet Divided into Two Subnets
If the class C address space is divided into two subnets, you might specify them as follows:
206.13.01.0/25 specifies  addresses 0 - 127
206.13.01.128/25 specifies  addresses 128 - 255

To better identify unassociated protocol names, making them easier to analyze, follow these steps:

1. Click Options.
2. Select Firewall Options.
3. Select the Protocols tab.
4. Reidentify the desired protocols. For example, if your log file is logging web activity as TCP/port80, identify the TCP/port80 protocol as "web activity".

Notes:

Note: For more information on classless subnets, refer to RFC1878.

NETIQKB1033