Cisco TelePresence Administrator's Manual page 64

4. Confirm that you want to activate the new rules. This will replace the existing set of active rules with the
set you have just configured.
After confirming that you want to activate the new rules, they are validated and any errors reported.
5. If there are no errors, the new rules are temporarily activated and you are taken to the
confirmation page.
You now have 15 seconds to confirm that you want to keep the new rules:
Click Accept changes to permanently apply the rules.
l
If the 15 seconds time limit expires or you click Rollback changes, the previous rules are reinstated
l
and you are taken back to the configuration page.
The automatic rollback mechanism provided by the 15 seconds time limit ensures that the client system
that activated the changes is still able to access the system after the new rules have been applied. If the
client system is unable to confirm the changes (because it can no longer access the web interface) then
the rollback will ensure that its ability to access the system is reinstated.
Rule settings
The configurable options for each rule are:
Field Description
Priority The order in which the firewall
rules are applied.
Interface The LAN interface on which you
want to control access.
IP address These two fields together
and Prefix determine the range of IP
length addresses to which the rule
applies.
Service Choose the service to which the
rule applies, or choose Custom
to specify your own transport
type and port ranges.
Transport The transport protocol to which
the rule applies.
Start and The port range to which the rule
end port applies.
Action Whether to Allow or Deny any IP
traffic that matches the rule.
Description An optional free-form description
of the firewall rule.
Cisco VCS Administrator Guide (X7.2)
Usage tips
The rules with the highest priority (1, then 2, then 3 and so on)
are applied first.
Firewall rules must have unique priorities. Rule activation will
fail if there are multiple rules with the same priority.
This only applies if the Dual Network Interfaces option key is
installed.
The Address range field shows the range of IP addresses to
which the rule applies, based on the combination of the IP
address and Prefix length.
The prefix length range is 0-32 for an IPv4 address, and 0-128
for an IPv6 address.
Note that if the destination port of a service is subsequently
reconfigured on the VCS, for example from 80 to 8080, any
firewall rules containing the old port number will not be
automatically updated.
Only applies if specifying a Custom service.
Only applies if specifying a UDP or TCP Custom service.
For deployments in a secure environment, you may want to
configure a set of low priority rules that deny access to all
services and then configure higher priority rules that selectively
allow access for specific IP addresses.
If you have a lot of rules you can use the Filter by description
options to find related sets of rules.
Network and system settings
Firewall rules
Page 64 of 498