Packeteer PacketShaper, securing interfaces and the MGMT port
admin on Jan 28th 2008
Some organisations choose to use a Packeteer PacketShaper on their Internet link. This gives them some rudimentary reporting and the ability to shape their Internet traffic*. When doing this it’s important that the box is secured. One of the steps in securing a PacketShaper is to not allow management access over the outside interface (called securing the interface). Some models also have a MGMT interface. So, why not connect the MGMT interface to the local network and then disable all management access to the Inside and Outside ports. That should allow us to manage the device internally while keeping it safe from all the script kiddies.
Unfortunately, no. To quote the page Specify Security Settings in Packeteer’s PacketGuide:
“Enable/disable access to the unit over the inside and/or outside interfaces (for example, ping, Telnet, or web access). The MGMT port (available on certain models) is considered an outside port. Therefore, securing the outside interface will secure the MGMT port as well.”
Now, some might call me stupid (and may do), but for the life of me I cannot think of any reason why the MGMT port should be linked to the Outside interface. I can think of a reason why it shouldn’t – so I can secure the Outside interface and use the MGMT port to manage the device.
What I can’t figure out is why Packeteer decided to do it the way they did.
It’s just not good enough!
* Shaping traffic like streaming video down to less than 1Kbps is popular. It means that IT can hold their hand on their heart and swear to all things holy that they aren’t blocking such traffic – while making such applications unusable.
Filed in BlueCoat/Packeteer | 2 responses so far
Haggai Aug 4th 2009 at 02:17 am 1
https://bto.bluecoat.com/packetguide/8.4/nav/tasks/configure/enable-management-port.htm documents the switch to enable exclusive management access through the management port only. this setting will disable management access to the unit through the inside and outside ports.
An IT dude Apr 27th 2010 at 05:56 am 2
I’m one of those IT guys who utilize a Packeteer because with 200 people in our office and 100 of them streaming internet radio (let’s see hmm 100 people using 1% of the internet each… you do the math, that’s called CHOKED INTERNET). So rather than hear people complain about slow internet, we would rather make sure REAL work – PRODUCTIVE internet traffic like MAIL, FTP, WEB work. Why is that so hard for you people to get?