Remedy's call tracking software; RPC

[roadrunner]

Remedy's call tracking software; RPC
have a customer is using Remedy's call tracking software internally, but it needs to be accessed by a single external site. Here is what happens:


-> The client (external) initiates contact with a
RPC request on port 111 (sun RPC?)

-> Server (internal) responds to client with an RPC
response saying to connect with TCP on one of
several ports b/w (usually) 626 and 636.

-> The client then sends a TCP packet to that port.
FW-1, of course, blocks the incoming TCP packet. Is there some way to get FW-1 to recognize the TCP packet as a response to the RPC? Alternatively, is there a way to define a service that will permit these packets to pass without opening the whole range to TCP addresses?

What you just described is pretty much a generic RPC service. RPC programs don't normally use fixed port. Rather, at start up time, each RPC program sents its program number and version number to the portmapper which will reply with a port number to which the calling RPC program can connect. FireWall-1 is capable of detecting the reply from the portmapper and will be able to dynamically open that port only for the duration of the RPC connection.

What you need to do is to define a new RPC service then use that service in a rule base. FireWall-1 will handle the port issue automatically. To define a RPC service, you will need to know the program number and version number. Check with the vendor of the software that makes the RPC call for those numbers. Usually, they are available in installation instruction. Look under section where user is asking to modify /etc/services file. Example User wants to use RPC service with the following characteristic:


Program number 10897654
Version number 1
User wants to allow


external machine '192.75.23.4' to connect to
internal machine '178.43.5.7'.
User will need to perform the following steps:


Add a new service object called remedy-rpc.
Add a network object called 'external-client' with IP 192.75.23.4
Add a network object called 'internal-server' with IP 178.43.5.7
Add the following rule to the current rule-base

Source Destination Service Action
external-client internal-server remedy-rpc accept

Install the new rule-base
-- GuyR - 18 Jan 2004


FAQForm
FAQs.Class: ServicesFAQs
FAQs.OS:
FAQs.Version: