Firewall on Demand

{% extends "base.html" %}

{% load i18n %}

{% block extrahead %}

<style type="text/css">

        #console {

                background: none repeat scroll 0 0 #36102a !important;

                color: #edeae8 !important;

                font-family: monospace !important;

        }

        .message {

                font-family: monospace !important;

        }

        .tooltip {

        display:none;

        background:transparent url(/fodstatic/black_arrow.png);

        font-size:12px;

        height:70px;

        width:160px;

        padding:25px;

        color:#fff;        

}

</style>

{% endblock %}

{% block title %}{% trans "Info" %}{% endblock %}

{% block breadcrumbs %}<li class="active"><span class="divider">/</span>{% trans "Info" %}</li>{% endblock %}

{% block content %}

{% csrf_token %}

<div>

    <h5>{% trans "Intro" %}</h5>

{% blocktrans %}Firewall on Demand service provides potential users (educational and academic community) the option to protect their networking equipment against network attacks and threats.

In particular, the service is targeted at network operators of GRNET's institutions who have needs for short-term protection against network attacks with destination, equipment they operate.

To ensure the integrity of the service and in order to prevent the service being a source of attacks, the authentication of users is done via Shibboleth. The authorisation is based on a combination of Shibboleth attributes with the address space that each organization manages.

The software chosen to implement the service is solely based on open source.

Requests or clarifications concerning the operation of the service should be submitted to GRNET Helpdesk via phone at 800-11-47638 or via e-mail to helpdesk-at-grnet.gr.

{% endblocktrans %}

<h5>{% trans "Joining the service" %}</h5>

{% blocktrans %}Joining the service requires the appropriate configuration of certain Shibboleth attributes{% endblocktrans %}:

                                <ul>

                                <li>HTTP_EPPN</li>

                                <li>HTTP_SHIB_HOMEORGANIZATION</li>

                                <li>HTTP_SHIB_INETORGPERSON_MAIL</li>

                                <li>{% blocktrans %}An appropriate HTTP_SHIB_EP_ENTITLEMENT which is provided by GRNET Helpdesk{% endblocktrans %}</li>

                                </ul>

                                {% trans "Optionally" %}:

                                <ul>

                                <li>HTTP_SHIB_INETORGPERSON_GIVENNAME</li>

                                <li>HTTP_SHIB_PERSON_SURNAME</li>

                                </ul>

<h5>{% trans "Use" %}</h5>

{% blocktrans %}The service enables users to mitigate active attacks aimed at their network equipment. 

It is based on the creation of dynamic firewall filters that are applied to the network using the management protocol NETCONF and are propagated to compatible (Juniper) backbone network devices via BGP flowspec NLRI.

In order to properly complete the application for a new filter is essential that the destination address belongs to the user's administrative network. Currently attacks are limited per /29 subnet.

Requests for new filters are applied directly to the network and therefore users should pay extra attention in their request. Filters that have been applied to the network are removed after their expiry date, and users can activate then again by selecting the corresponding option. 

Moreover, users are given the option for early deactivation of their requests.

{% endblocktrans %}

<h5>{% trans "Security" %}</h5>

{% blocktrans %}For security reasons, the submission of requests is monitored by the administrators of the service.

The service administrators may at any time remove active requests from the network, if this is deemed necessary{% endblocktrans %}

</div>

{% endblock %}