Define SFTP Connection Requirements Between Secure Proxy and Inbound Nodes

Edit online

You define connection requirements between Secure Proxy and inbound nodes by defining inbound node definitions. Refer to your company security requirements to determine how tightly to define the parameters that an inbound node must provide to allow a connection.

You can create inbound node definitions to allow only one individual inbound connection, or you can identify a pattern of IP addresses and create an inbound definition to allow inbound connections matching the pattern to connect to Secure Proxy. Methods of defining inbound nodes are as follows:
  • Create an entry for an individual inbound node and define the inbound node IP address to connect to Secure Proxy. Only connections from that IP address are allowed. A single IP Address must be specified as a subnet pattern where all bits are matched, such as 11.22.33.44/32. Secure Proxy also supports individual host names. They must match the value returned by a reverse DNS lookup.
  • Create an inbound node entry that allows all nodes that match an IP/Subnet address pattern. Patterns include:
    • Match the first 16 bits of an IP address pattern. For example, 10.20.0.0/16 allows all IP addresses that begin with 10.20.* to connect to Secure Proxy.
    • Match the first 8 bits of an IP address pattern. For example, 10.0.0.0/8 allows all IP addresses that begin with 10.* to connect to Secure Proxy.
  • Define an inbound node entry that allows all inbound nodes that match a wildcard host name pattern. When a connection is attempted and you have defined a wildcard host name pattern definition, a reverse DNS lookup is performed on the IP address of the inbound connection. The DNS name is compared to the wildcard pattern. Wildcard patterns include:
    • Asterisk (*) enables a match on any number of characters. For example, *.a.com allows a connection from b.a.com but not from a.bc.com. Using only the * allows all inbound nodes to successfully connect to Secure Proxy.
    • Question mark (?) enables a match on one character. For example, a.?.com allows a connection from a.b.com but not from a.bc.com.

You can define more than one inbound node definition and use a combination of the node definition methods. Order the definitions from most specific to least specific. When an inbound node connection is attempted, Secure Proxy compares the IP address of the inbound node to the first inbound node definition. If it matches, a connection is established. If it does not match, Secure Proxy checks the next inbound node definition until a match is found. If no match is found, the connection is terminated.