Define SFTP Connection Requirements Between Secure Proxy and Inbound Nodes

Edit online

You define connection requirements between Secure Proxy and inbound nodes by defining inbound node definitions. Refer to your company security requirements to determine how tightly to define the parameters that an inbound node must provide to allow a connection.

You can create inbound node definitions to allow only one individual inbound connection, or you can identify a pattern of IP addresses and create an inbound definition to allow inbound connections matching the pattern to connect to Secure Proxy. Methods of defining inbound nodes are as follows:

  • Create an entry for an individual inbound node and define the inbound node IP address to connect to Secure Proxy. Only connections from that IP address are allowed. A single IP Address must be specified as a subnet pattern where all bits are matched, such as 11.22.33.44/32. Secure Proxy also supports individual host names. They must match the value returned by a reverse DNS lookup.
  • Create an inbound node entry that allows all nodes that match an IP/Subnet address pattern. Patterns include:
    • Match the first 16 bits of an IP address pattern. For example, 10.20.0.0/16 allows all IP addresses that begin with 10.20.* to connect to Secure Proxy.
    • Match the first 8 bits of an IP address pattern. For example, 10.0.0.0/8 allows all IP addresses that begin with 10.* to connect to Secure Proxy.
  • Define an inbound node entry that allows all inbound nodes that match a wildcard host name pattern. When a connection is attempted and you have defined a wildcard host name pattern definition, a reverse DNS lookup is performed on the IP address of the inbound connection. The DNS name is compared to the wildcard pattern. Wildcard patterns include:
    • Asterisk (*) enables a match on any number of characters. For example, *.a.com allows a connection from b.a.com but not from a.bc.com. Using only the * allows all inbound nodes to successfully connect to Secure Proxy.
    • Question mark (?) enables a match on one character. For example, a.?.com allows a connection from a.b.com but not from a.bc.com.

You can define more than one inbound node definition and use a combination of the node definition methods. Order the definitions from most specific to least specific. When an inbound node connection is attempted, Secure Proxy compares the IP address of the inbound node to the first inbound node definition. If it matches, a connection is established. If it does not match, Secure Proxy checks the next inbound node definition until a match is found. If no match is found, the connection is terminated.

Inbound SFTP Connection Definition - Worksheet

Use the following worksheet to identify the information needed to configure inbound node definitions specific inbound nodes or groups of inbound nodes that match a pattern.

Configuration Manager Field

Define Inbound Trading Partner Information

Value
Note: If you define a single node and definitions for multiple nodes using pattern matching, order the definitions from most specific to least specific. Secure Proxy processes them in the order in which they are listed.

Inbound Node Name

Trading Partner Name

Policy

Policy to associate with the inbound trading partner

For a Single Node

Peer Address Pattern

IP address/32 or hostname

Create an entry for an individual inbound node and define the inbound node IP address that can connect to Secure Proxy. Only connections from that IP address will be allowed. Secure Proxy supports host name. An example definition is a.b.com.

A single IP address must be specified as a subnet pattern where all bits are matched, such as 11.22.33.44/32.

For Multiple IP Addresses Using IP/Subnet Pattern

Peer Address Pattern

Peer Address IP/Subnet Pattern Options

For Multiple Nodes Using Wildcard Peer Address Pattern to Validate Inbound DNS

Peer Address Pattern

Wildcard Peer Address Pattern