{"id":3030,"date":"2016-04-19T19:59:11","date_gmt":"2016-04-19T19:59:11","guid":{"rendered":"https:\/\/grnet.gr\/?page_id=3030"},"modified":"2022-10-20T11:53:08","modified_gmt":"2022-10-20T11:53:08","slug":"firewall-on-demand","status":"publish","type":"page","link":"https:\/\/grnet.gr\/en\/firewall-on-demand\/","title":{"rendered":"Firewall on demand"},"content":{"rendered":"

\n\t\t\t\t
\n

Firewall on Demand<\/a>\u00a0enables GRNET customers to filter flows of non-legitimate traffic (DoS\/DDoS) targeting their border router or internal networks.<\/p>\n

Access and authentication to the service portal relies on the SAML protocol (Shibboleth), while authorization is based on a number of pre-defined Shibboleth attributes released by the customer’s IdP and its address space as registered in RIPE’s db. All software modules are open source and have been implemented by GRNET\/NOC.<\/p><\/div>

\n

Users<\/strong><\/span><\/h4>\n

The following attributes are required for administrators and must be released by their home IdPs to the SP according to the policy and procedures documentation<\/a>\u00a0provided by the GRNET AAI federation:<\/p><\/div>

\n\n\n\n\n\n\n\n\n\n
\n

Attribute<\/b><\/span><\/h4>\n<\/th>\n

\n

Description<\/b><\/span><\/h4>\n<\/th>\n<\/tr>\n<\/thead>\n

eduPersonPrincipalName<\/td>\nProvides a string that uniquely identifies an administrator in the management application.<\/td>\n<\/tr>\n
eduPersonEntitlement<\/td>\nA specific URN value must be provided to authorize an administrator: urn:mace:grnet.gr:fod:admin<\/b><\/td>\n<\/tr>\n
mail<\/td>\nThe e-mail address (one or more) of the administrator. It is used for notifications from the management application. It may also be used for further communication with the administrator, with prior consent.<\/td>\n<\/tr>\n
givenName (optional)<\/td>\nThe administrator\u2019s first name.<\/td>\n<\/tr>\n
sn (optional)<\/td>\nThe administrator\u2019s last name.<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div><\/div>
<\/div><\/div>\n\t\t\t<\/div>
\n\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n

Implementation<\/span><\/h1><\/div><\/div><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>
\n\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n

About<\/strong><\/span><\/h4>\n

The service enables users to mitigate active attacks aimed at their network equipment. The creation of dynamic firewall filters that are applied to the network using NETCONF<\/a>\u00a0management protocol, and they are propagated to compatible (Juniper) GRNET backbone network devices via\u00a0BGP flowspec<\/a>\u00a0NLRI.<\/p>\n

Filters may be applied only to address space that belong to the customers’ network. Currently, attacks are limited as per \/29 subnet.<\/p>\n

Requests for new filters are applied and propagated immediately to the network’s elements. Filters that have been applied to the network are removed after their expiration date, and users can activate them again by selecting the corresponding option. Moreover, users are given the option for early deactivation of their requests.<\/p><\/div><\/div>

\n

Security<\/strong><\/span><\/h4>\n

Applications are monitored and reported upon request to the customer’s designated administrator(s). The service administrators may at any time remove active requests from the network, if deemed necessary.<\/p>\n

Requests or clarifications regarding the operation of the service should be submitted to GRNET Helpdesk (tel: 800-11-47638 + or via e-mail to helpdesk -@- grnet.gr<\/a>).<\/p><\/div><\/div><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>

\n\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/i>Firewall on Demand<\/a><\/div><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"categories":[],"tags":[349],"class_list":["post-3030","page","type-page","status-publish","hentry","tag-grnet-en"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/pages\/3030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/comments?post=3030"}],"version-history":[{"count":3,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/pages\/3030\/revisions"}],"predecessor-version":[{"id":12828,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/pages\/3030\/revisions\/12828"}],"wp:attachment":[{"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/media?parent=3030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/categories?post=3030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/grnet.gr\/en\/wp-json\/wp\/v2\/tags?post=3030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}