<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.3.1: http://docutils.sourceforge.net/" />
<title>Firewall Configuration Information for AGTk 2.0</title>
<meta name="author" content="Ivan R. Judson" />
<meta name="copyright" content="University of Chicago, 2003" />
<meta name="date" content="04-Dec-2003" />
<link rel="stylesheet" href="default.css" type="text/css" />
</head>
<body>
<div class="document" id="firewall-configuration-information-for-agtk-2-0">
<h1 class="title">Firewall Configuration Information for AGTk 2.0</h1>
<table class="docinfo" frame="void" rules="none">
<col class="docinfo-name" />
<col class="docinfo-content" />
<tbody valign="top">
<tr><th class="docinfo-name">Author:</th>
<td>Ivan R. Judson</td></tr>
<tr><th class="docinfo-name">Status:</th>
<td>Draft</td></tr>
<tr><th class="docinfo-name">Contact:</th>
<td><a class="first last reference" href="mailto:ag-info@mcs.anl.gov">ag-info@mcs.anl.gov</a></td></tr>
<tr><th class="docinfo-name">Copyright:</th>
<td>University of Chicago, 2003</td></tr>
<tr><th class="docinfo-name">Date:</th>
<td>04-Dec-2003</td></tr>
</tbody>
</table>
<div class="section" id="abstract">
<h1><a name="abstract">Abstract</a></h1>
<p>This document specifies what firewall configuration options need to be
considered to use the Access Grid in a firewalled network environment.
Specific firewall solutions are not addressed in this document.</p>
</div>
<div class="section" id="copyright">
<h1><a name="copyright">Copyright</a></h1>
<p>This document falls under the AGTkPL.</p>
</div>
<div class="section" id="discussion">
<h1><a name="discussion">Discussion</a></h1>
<p>The Access Grid Toolkit provides distributed collaboration system with
parts that communicate over both the local area and wide area
network. In order to function properly the various parts of the system
need to be able to initiate and use network connections in various
directions (both incoming and outgoing). The term connection refers to a
GSI Secured TCP Socket.</p>
<p>For the streaming media, which is carried via RTP, two ports are
required. The first (even numbered) port is the data port, the next
odd port (first port + 1) is used for RTP Control data.</p>
<p>In the current version of the toolkit, the network interfaces are
served via SOAP.</p>
<p>The minimal set of ports that need to be configured to allow access to
server interfaces includes:</p>
<table border class="table">
<colgroup>
<col width="23%" />
<col width="77%" />
</colgroup>
<thead valign="bottom">
<tr><th>Service</th>
<th>Default Port(s)</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>Venue Server</td>
<td>8000, 8002, 8004, 8006</td>
</tr>
<tr><td>Beacon Server</td>
<td>(233.4.200.21:10002,10004), beacon.dast.nlanr.net:10004</td>
</tr>
</tbody>
</table>
<p>Additionally, these optional interfaces provide richer collaboration:</p>
<table border class="table">
<colgroup>
<col width="20%" />
<col width="80%" />
</colgroup>
<thead valign="bottom">
<tr><th>Service</th>
<th>Default Port(s)</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>Venue Client <a class="footnote-reference" href="#id3" id="id1" name="id1"><sup>*</sup></a></td>
<td>1 dynamically assigned</td>
</tr>
<tr><td>Bridge Server</td>
<td>Each stream uses a statically configured or dynamically assigned port</td>
</tr>
</tbody>
</table>
<p>These services make no <em>wide area</em> network connections, but do require any
firewall on the local machine be configured to allow access <a class="footnote-reference" href="#id4" id="id2" name="id2"><sup>†</sup></a>.</p>
<table border class="table">
<colgroup>
<col width="31%" />
<col width="69%" />
</colgroup>
<thead valign="bottom">
<tr><th>Service</th>
<th>Default Port(s)</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>Services</td>
<td>one dynamically assigned port per service</td>
</tr>
<tr><td>Service Manager</td>
<td>11000</td>
</tr>
<tr><td>Node Service</td>
<td>12000 and 1 dynamically assigned port</td>
</tr>
</tbody>
</table>
<table class="footnote" frame="void" id="id3" rules="none">
<colgroup><col class="label" /><col /></colgroup>
<tbody valign="top">
<tr><td class="label"><a class="fn-backref" href="#id1" name="id3">[*]</a></td><td>Disabling incoming connections to the Venue Client is possible and doesn't significantly hinder collaboration. Personal data sharing is not possible if incoming connections are not allowed.</td></tr>
</tbody>
</table>
<table class="footnote" frame="void" id="id4" rules="none">
<colgroup><col class="label" /><col /></colgroup>
<tbody valign="top">
<tr><td class="label"><a class="fn-backref" href="#id2" name="id4">[†]</a></td><td>Host based firewalls like Microsofts XP Firewall will interfere not only with local area connectivity but it will also stop multicast from working properly. Currently, the best advice is to turn the firewall off.</td></tr>
</tbody>
</table>
<div class="section" id="service-details">
<h2><a name="service-details">Service Details</a></h2>
<ul>
<li><p class="first">Venue Server (defaults to port 8000, 8002, 8004, 8006)</p>
<p>The venue server listens for incoming connections on four ports, which
are configurable. These ports are for incoming connections only, there
are no outbound connections from the venue server.</p>
</li>
<li><p class="first">Bridge Server (multiple ports used)</p>
<p>The bridge server can use either statically assigned ports for the
media bridges it starts, or it can dynamically assign the ports for
media bridges.</p>
</li>
<li><p class="first">Beacon Server (one multicast group, one outgoing connection)</p>
<p>The beacon server uses one multicast group and one outbound
connection to a reporting server. These are both configurable, but
the defaults are the correct configuration to be a part of the
Access Grid Multicast Beacon infrastructure.</p>
</li>
</ul>
</div>
<div class="section" id="multicast">
<h2><a name="multicast">Multicast</a></h2>
<p>In order for audio and video to flow among users multicast needs to be able to be allowed through the firewall. There is currently no set of static configurations that are used for multicast (although they could be used, if needed), so ideally the firewall would allow data from any group <em>that is subscribed to from
inside</em> the firewall to come through the firewall from the outside.</p>
<p>The media tools we use have two different behaviors for how they send data. For audio the source port for the data is identical to the destination port for the data. For video, the source port for the data is selected randomly.</p>
</div>
</div>
<div class="section" id="example-of-a-secured-static-environment">
<h1><a name="example-of-a-secured-static-environment">Example of a Secured Static Environment</a></h1>
<p>This is an example of a small installation configured for a paranoid
network configuration. The configuration has only three venues to keep
the example simple.</p>
<p>To keep this example even more simple, the bridge, data and venue
server are all running on the same machine, <em>host.domain</em>.</p>
<div class="section" id="meeting-room-venue">
<h2><a name="meeting-room-venue">Meeting Room Venue</a></h2>
<table border class="table">
<colgroup>
<col width="27%" />
<col width="47%" />
<col width="27%" />
</colgroup>
<thead valign="bottom">
<tr><th>Media</th>
<th>Multicast Groups</th>
<th>Bridge Ports</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>static video</td>
<td>224.1.2.3/1234,1235</td>
<td>9000,9001</td>
</tr>
<tr><td>static audio</td>
<td>224.1.2.3/1236,1237</td>
<td>9002,9003</td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="laboratory-1-venue">
<h2><a name="laboratory-1-venue">Laboratory #1 Venue</a></h2>
<table border class="table">
<colgroup>
<col width="27%" />
<col width="47%" />
<col width="27%" />
</colgroup>
<thead valign="bottom">
<tr><th>Media</th>
<th>Multicast Groups</th>
<th>Bridge Ports</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>static video</td>
<td>224.1.2.4/1234,1235</td>
<td>9004,9005</td>
</tr>
<tr><td>static audio</td>
<td>224.1.2.4/1236,1237</td>
<td>9006,9007</td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="laboratory-2-venue">
<h2><a name="laboratory-2-venue">Laboratory #2 Venue</a></h2>
<table border class="table">
<colgroup>
<col width="27%" />
<col width="47%" />
<col width="27%" />
</colgroup>
<thead valign="bottom">
<tr><th>Media</th>
<th>Multicast Groups</th>
<th>Bridge Ports</th>
</tr>
</thead>
<tbody valign="top">
<tr><td>static video</td>
<td>224.1.2.5/1234,1235</td>
<td>9008,9009</td>
</tr>
<tr><td>static audio</td>
<td>224.1.2.5/1236,1237</td>
<td>9010,9011</td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="beacon-service">
<h2><a name="beacon-service">Beacon Service</a></h2>
<ul class="simple">
<li>running on host.domain</li>
<li>Multicast Group: (233.4.200.21, 10002/10003)</li>
<li>Outbound TCP: beacon.dast.nlanr.net:10004</li>
</ul>
</div>
</div>
<div class="section" id="summary-configuration">
<h1><a name="summary-configuration">Summary Configuration</a></h1>
<p>Incoming <strong>to host.domain</strong> from outside the firewall:</p>
<ul class="simple">
<li>Ports: 8000, 8002, 8004, 8006, 9000-9011</li>
</ul>
<p>Multicast Groups (All hosts on the local network should be able to send and
receive traffic via these multicast groups):</p>
<ul class="simple">
<li>(224.1.2.3:1234,1235,1236,1237)</li>
<li>(224.1.2.4:1234,1235,1236,1237)</li>
<li>(224.1.2.5:1234,1235,1236,1237)</li>
<li>(233.4.200.21:10002,10003)</li>
</ul>
</div>
<div class="section" id="conclusion">
<h1><a name="conclusion">Conclusion</a></h1>
<p>This document describes the firewall requirements for the AGTk 2.0 software,
for both clients and services. For more information please see:</p>
<ul class="simple">
<li><a class="reference" href="http://www.mcs.anl.gov/fl/research/accessgrid">The AGTk Home Page</a></li>
<li><a class="reference" href="http://www.accessgrid.org/">The Access Grid Project Home Page</a></li>
<li><a class="reference" href="http://www.accessgrid.org/agdp">The Access Grid Documentation Project Home Page</a></li>
</ul>
<!-- Local Variables:
mode: indented-text
indent-tabs-mode: nil
sentence-end-double-space: t
fill-column: 70
End: -->
</div>
</div>
</body>
</html>