Re: sunscreen and stealth interfaces

On Wed, Mar 10, 2004 at 12:47:39PM +0000, [email protected] wrote:
> Hello,
> 
> I am trying to test sunscreen in stealth mode (Solaris 9).
> But have warning:
> edit> verify
> Warning: Stealth Interfaces detected but STEALTH_NET not specified.
> Configuration verified successfully (not activated).
> edit> save
> Saved policy to test version 75
> edit> quit
> # ssadm activate test
> Warning: Stealth Interfaces detected but STEALTH_NET not specified.
> Configuration activated successfully on fdelta.
> 
> Can anybody explain me why the warning is occuring ?

You have to define what network the screen (effectively operating as a dumb bridge, by dumb I mean no spanning trees) is "stealthifying":

http://docs.sun.com/db/doc/806-6347/6jfa0g877?q=stealth_net&a=view

"If the Screen is configured in stealth mode, the network that it partitions and the netmask must be specified. In the configuration editor this is accomplished using the STEALTH_NET #.#.#.# #.#.#.# keyword, where the first #.#.#.# is the network address and the second #.#.#.# is the netmask. In the administration GUI, these parameters are the Stealth Net Address and Stealth Netmask, respectively, in the Miscellaneous tab of the Screen object."

http://docs.sun.com/db/doc/806-6347/6jfa0g89n?q=stealth_net&a=view

"STEALTH_NET #.#.#.# #.#.#.# {Network and Netmask for stealth type Interfaces}

STEALTH_NET #.#.#.#/#.#.#.#

STEALTH_NET #.#.#.#/#bits"

Also consider the ROUTER option, especially with VPNs.

-- 
adam