text:
A Secure Web-based Global Management System For Firewall/VPN Devices
- Ashley Eaton
- 3 years ago
- Views:
1 1 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC A Secure Web-based Global Management System For Firewall/VPN Devices Mi-Joung Choi and James W. Hong Department of Computer Science and Engineering Pohang University of Science and Technology {mjchoi, Abstract A firewall is a security device placed between a private network and a public network such as the Internet. It is designed to protect the private network resources from unauthorized user access. Today, various firewalls are widely used in many places (e.g., Internet data centers, company headquarters, branch office, telecommuters homes). What is desperately needed is a management system that can easily configure, monitor and manage multi-site deployed firewalls from a central location. For flexibility, such a management system must be divided into components and needs to use an open management protocol, such as the Simple Network Management Protocol (SNMP). Yet the SNMP has a security defect. Further, the proposed standard Management Information Base (MIB) for firewalls is insufficient for supporting centralized global management of a lot of firewall devices. In this paper, we present the design and implementation of a secure Web and SNMP-based global firewall management system. We have focused on two aspects: 1) extending the existing proposed standard MIB to support the configuration and monitoring of hundreds or thousands of firewall and VPN devices; 2) providing secure communication among global manager system components in order to provide secure firewall management. We also present our work on developing our firewall global manager (FGM) on commercial firewall/vpn devices. System Keywords Firewall, VPN, Global Management, Secure Communication, SNMP, MIB, Web-based Management
2 I. INTRODUCTION The Internet has made vast amounts of information available to various users. For many people, having access to this information is no longer just an advantage, it is essential. But the Internet is a publicly accessible network, so commercial transactions on the Internet are often concerned about security risks. The most popular and easiest way to reduce security risks is to use firewalls [1, 2, 3]. A firewall is a security device placed between a private network and public network (such as the Internet). It is designed to prevent unauthorized users from gaining access to confidential corporate and customer resources in the private network. Using firewalls, organizations can protect private network resources from security problems. For this reason, firewalls are generally used in many organizations. In large organizations and data centers, the deployment of tens or hundreds of firewalls is common. In many cases, these firewalls may be geographically distributed. Thus, a management system for multi-site deployed firewalls from a central location is necessary. Today, firewall management systems use proprietary protocols and manage only internal firewall products. Due to the use of a proprietary protocol, the management system cannot manage various firewalls from a central location. To solve this problem, we consider an open management protocol. Using Simple Network Management Protocol (SNMP) [4], the management system can manage diverse firewalls equipped with an SNMP agent. In general, firewalls are not equipped with an SNMP agent for security reasons and a firewall MIB [5] is not sufficient. Therefore, an MIB for firewalls and security communication consideration of SNMP is necessary. Firewall devices are diverse and the diffusion environments of firewalls are also various. To apply a firewall management system to any circumstance, the management system must provide flexibility. Consequently, the architecture of the firewall management system must be divided into management components during system design. For this reason, communication between management elements must be secure. Moreover, the firewall is a device, which guarantees security and thus the management system for firewalls itself must be foolproof. For this, the security mechanism must be supported in communications between the management elements. In this paper, we present the design and implementation of a secure Web and SNMPbased global firewall management system. We have mainly focused our research and
3 3 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC development on two aspects: 1) extending the existing proposed standard MIB to support the configuration and monitoring of hundreds or thousands of firewall and VPN devices; 2) providing secure communication among global manager system components in order to provide secure firewall management. We also present our work on developing our firewall global manager (FGM) on commercial firewall devices. The organization of this paper is as follows. In Section 2, we present related work to the firewall and security issues. In Section 3, we examine the proposed standard MIB for firewalls and present an extended MIB which satisfies the requirements for global management of firewall devices. In Sections 4 and 5, the requirements and design for a firewall global manager are presented, respectively. In Section 6, we describe the implementation of our proposed FGM architecture. In Section 7, we briefly compare our FGM with firewall management systems by focusing on their features. In Section 8, we summarize our work and discuss possible future work. II. RELATED WORK In this section, we briefly overview firewalls. Further, we describe the proposed standard firewall monitoring MIB [5]. We also examine security protocol mechanisms for client and server communication FIREWALL A firewall protects networked resources from hostile intrusion that can compromise confidentiality or result in data corruption or denial of service. It may be a hardware device or a software program running on a secure host computer. Figure 1 shows a hardware firewall providing protection to a local network [6].
4 Private Local Network Internet FAX & MODEMS READ Firewall FAX & MODEMS READ Firewall Public network Secure Private network Figure 1. Firewall The firewall monitors requests for access and authorizes individual users using various authentication methods. The Firewall stores each request for access to a private network - whether attempts are successful or not. The firewall will immediately alert the designated network administrator of any suspicious activity. In addition to protecting the internal network from an external attack, a firewall can also be used to prevent the abuse of Internet resources from within, by logging and controlling the use of the Internet by users on a local area network (LAN). By logging every connection between the LAN and the Internet, firewalls enable managers to account for Internet usage by employees, making those individuals or departments responsible. Internal abuse of Internet resources can be quickly identified and terminated, achieving in complete control of internal network operations Moreover, most firewall devices have Virtual Private Networks (VPN) [7] functionalities. VPN offers a secure way of extending services on the corporate network to customers and business partners, IPSec-encrypted VPN tunnels are supported by most firewall devices. VPN enables businesses to achieve a secure connectivity to remote and branch offices without the expense of leased lines, creating another potential revenue stream for service providers. In this paper, firewall devices mean firewall and VPN devices; that is, firewall devices support their essential functionalities and VPN functionalities FIREWALL MIB
5 5 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC The firewall MIB [5] defines a portion of the Management Information Base (MIB) for use with network management protocols in TCP/IP-based Internets. In particular, it defines objects for monitoring firewall devices. The objects of the firewall MIB are arranged into the following groups: service identifiers (service), firewall event variables and logs (fwevent), firewall status and statistics data (fwquery), and firewall traps (fwtrap). These groups are defined to provide a means of assigning object identifiers, and to provide a method for managed agents to know which objects they must implement THE SERVICE IDENTIFIERS GROUP The service group defines object identifiers (OIDs) for resources, classes of services, and particular services handled by firewalls. These OIDs are used as values in variables in other groups of the MIB to designate a service. In this document and MIB definition, "resource" is defined as any service, application, proxy, hardware unit, utility, operating system, product, engine, etc. on the firewall. Resource can also refer to the firewall as a whole. Further, the term "service" is used interchangeably with "resource" throughout the document and the MIB THE FIREWALL EVENT VARIABLES AND LOGS GROUP The fwevent group defines tables for logging events that take place on the firewall. Management stations are notified of the events via traps from the fwtrap group THE STATUS AND STATISTICS GROUP The fwquery group contains status and statistical information. It includes version information for the firewall and its resources and services. It includes version information, status details, and statistics measured by firewall resources and services THE FIREWALL TRAPS GROUP The fwtrap group defines the traps that a firewall can send. When an event occurs on the firewall, the basic table information is collected, and based on the event, a details table is chosen and its information is collected as well. This information is stored on the firewall and a trap from the fwtrap group is sent. The trap contains the same information contained in the basic table.
6 The purpose of the MIB defined in firewall monitoring MIB [5] is to provide information for the purpose of monitoring firewall activity. The objects defined here provide information about urgent events, security, health and status, and the performance of a firewall. This information is provided in two ways, via traps and through objects that must be queried. The traps also have associated information that can be queried. The Cisco firewall MIB [8] provides a good example defining a private firewall monitoring MIB. This MIB is based on the IETF firewall monitoring MIB [5] SSL The Secure Socket Layer (SSL) [9] protocol runs above the Transmission Control Protocol/Internet Protocol (TCP/IP) [10] and below the higher-level protocols, such as HyperText Transport Protocol (HTTP) [11], Lightweight Directory Access Protocol (LDAP) [12], or Internet Messaging Access Protocol (IMAP) [13]. It uses TCP/IP on behalf of the higher-level protocols, and in the process allows an SSL-enabled server to authenticate itself to an SSL-enabled client, allowing the client to authenticate itself to the server, and allowing both machines to establish an encrypted connection. HTTP LDAP IMAP Application layer Secure Sockets layer layer TCP/IP TCP/IP layer layer Transport Layer Figure 2. SSL between TCP/IP and high-level application protocols SSL server authentication allows a user to confirm a server's identity. SSL-enabled client software can use standard techniques of public-key cryptography to verify that a server's certificate and public ID are valid and have been issued by a Certificate Authority (CA) listed in the client's list of trusted CAs. SSL client authentication allows a server to confirm a user's identity using the same techniques as those for server authentication. An encrypted SSL connection requires all information sent between a client and a server to be encrypted by the sending software and decrypted by the receiving software, thus providing a high degree of confidentiality. Confidentiality is important for both parties in any private transaction. In addition, all data sent over an encrypted SSL connection is protected with a mechanism for detecting tampering--that is, for automatically determining whether the data has been altered in transit.
7 7 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC HTTPS The secure HyperText Transfer Protocol (HTTPS) [15] is a communications protocol designed to transfer encrypted information between computers over the World Wide Web (WWW). HTTPS is HTTP using a Secure Socket Layer (SSL) [14]. A secure socket layer is an encryption protocol invoked on a Web server that uses HTTPS. In other words, the main difference is the introduction of a set of new properties and events that deal with SSL security. The HTTPS component implements a standard HTTP client through a simple plugand-play interface and the added option of SSL security. Most implementations of the HTTPS protocol involve online purchasing or the exchange of private information. Accessing a secure server often requires some sort of registration, login, or purchase. The HTTPS component supports the HTTP basic authentication scheme through user and password properties. Other authentication schemes can be implemented by using the authorization property IPSEC The Internet Engineering Task Force s (IETF) IP Security (IPSec) [16] Working Group is developing standards for IP-layer security mechanisms for both IPv4 (the version currently used on the Internet at the time of this writing) and IPv6 (the next generation of TCP/IP). The IPSec architecture includes authentication (how to know if the site communicating to your site really is who it claims to be) and encryption. These mechanisms can be used together or independently. IPSec is a series of guidelines for the protection of Internet Protocol (IP) communications. It specifies ways for securing private information transmitted over public networks. Services supported by IPSec include confidentiality (encryption), authenticity (proof of sender), integrity (detection of data tampering), and replay protection (defense against unauthorized re-sending of data). IPSec also specifies methodologies for key management. Internet Key Exchange (IKE) [17], the IPSec key management protocol, is a series of steps that establishes keys for encrypting and decrypting information. It defines a common language on which communications between the two parties is based. IPSec and IKE together standardize the performance of data protection, thus making it possible for security systems developed by different vendors to interoperate. III. EXTENDED FIREWALL MIB
8 The proposed standard firewall MIB is not ideal for reporting on the configuration of a firewall or for globally management. Currently, most firewalls use unique and/or proprietary protocols and representations for dealing with configuration and 'policy'. This MIB does not have much variables related to configuration items. It would be too difficult to try to create a generic set of MIB objects that could represent most firewall configurations. However, firewall MIBs for configuration and policy are necessary [5]. Therefore, we extend the firewall MIB for firewall configurations. For extending the MIB for firewall configuration, we first must consider the role of firewall. The main functions of a firewall [18] are to control access according to management policies and to configure the Virtual Private Networks (VPN) [7]. Therefore, to provide firewall management functionality, the MIB should include, at minimum, the following five parts: system information, policy definition, VPN settings, log monitoring data, hardware status. Generally, the firewall has three interfaces: an internal, an external, and a DeMilitarized Zone (DMZ). The internal interface is for private internal networks, the external interface is connected to the public networks. The interface for a DMZ is an isolated, protected network that allows users to host public services, such as a Web or FTP site, on local servers. Firewall system information, such as the system name, DNS server, system date, default gateway, and the IP address and netmask of the three interfaces needs to be configured. The MIB for system information contains all of the above information. To protect the internal network, security policies that define a set of rules for network traffic must be created. For example, we can allow only a certain machine or subnetworks to send outgoing traffic to the Internet, or restrict outgoing traffic to only certain protocols, such as HTTP or FTP at the specific time. The policy needs to define the source and destination address, service type, scheduling, logging or not, action, quality of service (QoS), and so on. Figure 3 shows the entries of policy tables. The schedule is defined as a MIB table, and an entry of the table contains the schedule name, start & end times (year, month, day, hour, minutes). The policyschedule of the policy table in Figure 3 is the schedule name of the schedule table. The other entries in the policy table are defined as MIB tables. Despite some complexity, administrators can manage different types of policies.
9 9 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC table entry of policy MIB PolicyListEntry ::= SEQUENCE { PolicyNo INTEGER, PolicySource DisplayString, PolicyDestination DisplayString, PolicyService DisplayString, PolicySchedule DisplayString, PolicyLogging DisplayString, PolicyAction DisplayString, PolicyAlias DisplayString, PolicyQos DisplayString } Figure 3. Example of policy table entry We can configure a VPN between two sites using IPSec, or remote users can use their Internet Service Provider (ISP) to access the corporate Internet via PPTP [19]. The MIB for a VPN has configuration parts for IPSec and PPTP. For PPTP configuration, we require start IP, end IP, or enable PPTP or not. To create a site-to-site VPN, we must create a Security Association (SA) that defines the encryption algorithms and other information that the two sites use to establish the connection. The VPN MIB using IPSec must have the stated data. For monitoring security and traffic on the network, it is necessary to manage logs for traffic, security, and event. The MIB for monitoring has configuration parts for logging behavior and tables for each log type. We referred to the proposed standard firewall monitoring MIB [5] and the Cisco monitoring MIB [8] explained in the Section 2.2 in defining our monitoring MIB. To periodically monitor the firewall hardware status, the MIB for system status contains the following information: fan speed, CPU temperature, log capacity, up time, and so on. Trap types for system status and attack trial from unauthorized users must also be defined. Besides these basic MIBs for firewall configuration, a more detailed MIB can be defined for the specific firewall. IV. REQUIREMENTS In this section, we discuss the requirements that must be considered for the development of a firewall global management system MANAGEMENT OF FIREWALLS In order to implement an FGM, some functional requirements must be considered. The FGM requires the following management functionality: managing each firewall s
10 configuration, and monitoring each firewall s status and logging, and managing FGM configuration and administration. The basic role of FGM is managing multiple firewall devices from a central location. The FGM must support multiple firewall device view/control panels. FGM administrators can access firewalls and modify firewall configurations. The FGM must support a backup/restore mechanism for firewall configuration per each firewall device, to use other firewall configurations or to backup the current firewall configuration. Each firewall monitors security on networks through several types of network logs: security, event, and traffic. Therefore, the FGM must perform a log analysis of each firewall. Further, the FGM must periodically monitor the status of firewall hardware, such as CPU temperature, fan speed, log capacity, up time, and so on. This will determine the current firewall hardware status and notify an administrator if the firewall does not respond, or if a problem exists with the value of status parameters. The FGM must be able to manage lots of (hundreds or thousands) firewalls. Therefore, the FGM must support the view of a multi-level hierarchical directory structure of devices or device groups and manage firewalls according to the directory structure. There are many administrators for managing multiple firewalls. The FGM also needs to support multiple administrator accounts. The FGM keeps information on each administrator and assigns firewalls to each administrator. Next, administrators can access the assigned firewall device/device groups. For supporting multiple administrators logging, FGM needs to support simultaneous multiple login sessions and a notification mechanism for firewall device information updates SECURITY Security is an important concern in network management in different applications, especially those that involve equipment configuration or administration. Moreover, a firewall is a security device. Therefore, the firewall management process must guarantee security. It is necessary to limit the access to FGM to a specific set of users. Simple authentication and access-control mechanisms are the preferred method to provide primary security. In existing management systems for network devices, such as router, switch, and cache engine have only a simple authentication mechanism. But the FGM must provide more secure access-control mechanism. Further, secure communication is required between management elements, such as between the management client and the management server, or between
11 11 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC the management server and firewalls FLEXIBILITY As Internet usage becomes more widespread and the scale of organization increases, firewall usage will become more various and firewall products more diverse. The management environment of firewalls must support this diversity. For supporting various environments, the architecture of FGM must be flexible. The FGM must be divided into management components for flexibility. Communication between management components must be considered. As a result, the FGM is applicable to any firewall devices and any management environments of firewall spread. V. DESIGN In this section, we present our FGM architecture and communication protocol according to the following requirements: management functionality, security and flexibility FGM OVERALL ARCHITECTURE We have designed our FGM based on a 3-tier architecture. The FGM consists of three management elements: the management client, the management server, and the managed device. Figure 4 shows the overall architecture of our FGM. Management Client 1 Main Device Control Window Device Control Device Control Management Client 2 Main Device Control Window Device Control Management Client 3 Device Control Main Window Device Control Device Control Device Control Syslog Demon Firewall Global Manager Management Server DB Firewall Device Firewall Device Managed Devices Firewall Device Figure 4. FGM Overall Architecture The management clients have a main window to view all managed devices and multiple device control widows to view the management information for each device. The management server largely consists of three parts: a global manager performing the main
12 management function, a syslog daemon gathering log for log analysis, a DB storing whole management information. The managed devices are firewalls equipped with a management agent. We select that the management user interface is a Web interface. The Web server receives a request from the management clients and sends the request to an FGM. Each firewall is equipped with an SNMP [4] agent. Our FGM is based on the same 3-tier Web-Based Management (WBM) [20] architecture and paradigm. But communication protocols between management elements are more secure than those of the existing Web-based network management systems MANAGEMENT COMMUNICATION PROTOCOLS Basically, in Web-Based Management (WBM) [20], the communication protocol between management clients and the Web server is HTTP [11], and between the management server and managed device is SNMP. Yet, we use the HTTPS protocol between management clients and the Web server, and IPSec between the FGM and firewalls for security. Therefore, the SNMP protocol runs over the IPSec protocol in our FGM architecture. As mentioned in Section 2, the HTTPS [15], SSL [9, 14], and IPSec [16] mechanisms help secure communication. Figure 5 shows the communication protocol between management elements: management Web clients, the FGM, and firewalls. Management Clients (Web browser) HTTPS Web Server CGI Module CGI CGI CGI CGI.. CGI SSL Firewall Global Manager Trap (SNMP/IPSec) SNMP/IPSec Firewall Device Figure 5. FGM Communication Protocols Generally, the Web server and an FGM run on the same machine, but in some cases, the multiple FGMs use a single Web server. Thus, it is necessary to communicate between the Web server and the FGM. For flexibility of the FGM, we consider communication between the Web server and the FGM. The SSL connection is selected for security reasons. The
13 13 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC components of the management server, such as the Web server, global manager, syslog daemon, and a DB can be located in a different machine. Naturally, these components are different software modules. We will explain the more detailed architecture of FGM considering the flexibility in the following section. Many SNMP implementations and network architectures do not support secure communications. Without a secure connection, the firewall configuration could be exposed. Therefore, we must secure communication between the FGM and firewalls. We considered SNMPv3 [21] for security reasons, but the firewalls already have an IPSec module for the VPN setting. If we use this IPSec module for security communication below SNMP, the resource overhead for executing SNMPv3 is removed. Moreover, according to the report of Hia, H. Erik [22, 23], the SNMPv2c-over-IPSec solution and the SNMPv3 impose similar amounts of computational overhead on network devices. The SNMPv3 solution consumes as much as 24% more network capacity than the SNMPv2c-over-IPSec solution. Conversely, consumes as little as 11% less mean processing time. As a result, we chose SNMP over IPSec FGM DETAILED ARCHITECTURE The main functions of the FGM were described in Section 4.1. The FGM consists of the following components: a request handler, an FGM administration manager, an FGM configuration manager, a device node tree manager, a device manager, etc. Figure 6 shows the components of FGM and the relationships between the components..
14 Global Manager Request from client to server s listening port Request Handler Notification Handler Send a notification to client s listening ports Login Admin Manager Account Manager DB mysql DNT Manager Property Manager Stored in config. file Device Config. Manager Communication using SNMP & IPSec Device Config. Backup Manager Dev. Config Backup Device Log Manager Device Log Send an Alert Sender Thread Auto-backup of periodic dev. config. Thread Log processor from syslog fifo Trap to server Firewall Device Send log to server Figure 6. Detailed Architecture of FGM The request handler receives management requests, processes the requests and calls the other components according to the request. The account manager manages administrator account information, such as ID, password, the login status, etc. The Device Node Tree (DNT) manager handles the multi-level device tree directory architecture. The information on administrators and DNT is stored in DB tables. The property manager handles the configuration parameters of the FGM, such as automatic logout timeout, log directory capacity, log directory location, and so on. The parameters are stored in the configuration file. The login admin manager manages the administrators presently logged in the FGM. The device configuration manager manages the firewall device configuration, such as system information, policy definition, VPN setting, via SNMP/IPSec protocol. The autobackup thread of periodic device configuration will backup the device configuration automatically during a fixed period at the device backup directory in the FGM configuration file. The device configuration backup manager manages the auto or manual backup configuration setting of each firewall. The log processor thread stores log data from the syslog First-In-First- Out (FIFO) queue into a device log directory. Next, the device log manager analyzes the log data based on the administrator s demand. The alert sender receives a trap notification from firewalls and sends an alert to the administrators listed in the DB table. The notification manager notifies the DNT hierarchical structure update or device information update to the other administrators currently logged in for the synchronization of management data.
15 15 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC VI. IMPLEMENTATION We have implemented an FGM based on the FGM design presented in the previous section, and have applied the FGM to the management of commercial firewall devices. The name of the firewall is Broadband Internet Gateway (BIG) [24]. We have developed FGM on a later version of Linux OS, JDK [25] and ucd-snmp [26] using g++/gcc compiler FEATURES OF OUR FGM Our FGM provides a Web-based management user interface. The FGM supports all the management functionalities mentioned in the Section 4.1. The FGM supports multiple administrator accounts: one super administrator, and multiple regular administrators. The super administrator is allowed to operate FGM without restrictions. Further, the FGM supports simultaneous multiple login sessions. The FGM can manage a multi-level hierarchical directory structure of firewall devices/device groups. That is, a device group can have devices as well as device groups. We can import/export the FGM configuration data in ASCII format for purposes of backup or reuse. Through the FGM, we can view and control multiple firewall devices from the same location. The FGM notifies BIG device information update and Device Node Tree (DNT) hierarchy structure update to the other administrators currently logged in. The FGM supports a backup/restore mechanism for BIG device configuration per each BIG device. We can monitor the hardware system status, such as fan speed, CPU temperature, log capacity, up time, only if a firewall device control/monitoring panel is up. The FGM supports BIG device remote logging through a syslog demon, then analyzes log data from each BIG device. For example, we analyze traffic data, gain bandwidth utilization by hosts or protocol and the top 20 IP addresses with the most packets being transmitted through the BIG device and the top 20 protocols appear in the log, such as HTTP, FTP, TELNET, etc. Figure 7 shows the whole features of FGM such as the architecture, administration, device grouping, and communication protocol. As shown in Figure 7, the FGM supports secure communication between the management elements.
16 Web Interface BIG Device Group1 managed by Admin (a) Super admin HTTPS/SSL Multiple login sessions SNMP /IPSec Admin (a) HTTPS/SSL FGM BIG Device Group2 managed by Admin (b) Admin (b) Regular admin BIG Device Group3 Figure 7. Features of FGM Figure 8 shows an example of a FGM management user interface. The left part of the figure shows the DNT panel, the hierarchical structure of firewalls. On the right is the main window with the management information. The right upper part shows the menu: FGM configuration, import/export, help, logout. The current management data is the information of a firewall device, such as device name, device type, IP address, administrator ID, addresses to send alert mail. DNT Panel Device Information Figure 8. FGM Management Interface Figure 9 shows the main BIG management user interface. If we double click each device icon on the DNT panel in Figure 9, a new window for the BIG device management appears. The left part of the Figure 9 shows the management menu: system information, administration, policy, VPN setting, caching, monitoring, and so on, the upper part is showing the current BIG system status: fan speed, CPU temperature, log capacity, and up
17 17 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC time. This monitoring data is periodically updated. BIG Device Monitoring Figure 9. BIG Management Interface VII. COMPARISON WITH FIREWALL MANAGEMENT SYSTEMS We briefly compare firewall management products by focusing on their features. The firewall products are very diverse and widespread, yet, firewall management systems are few. The known firewall management products are WatchGuard s LiveSecurity Control Center [27], SonicWall s Global Management System [28], Netscreen s Netscreen Global Manager [29], and so on. This table compares the features of commercially available firewall management products and our FGM. Blank columns represent features not supported, or we could not find appropriate information on them from the available literature. Table 1. Comparison our FGM with other firewall management products Company & products WatchGuard s LiveSecurity Control Center SonicWall s Global Management System NetScreen s Netscreen Global Manager OpenService s SystemWatch Admin. Multiple admins. Single admin. Multiple admins. Multiple admins. Mgmt. of topology Yes Yes Yes Log reporting & Analysis Event, traffic log Event, Security log Event log Event log Multiple login Single user login Single user login Multiple user login session Import/ Export Yes Yes OS supported Windows 95/98/NT4.0 NT4.0/ Windows2000/ Solaris NT4.0/ Windows2000/ Solaris NT, Solaris Communication Encrypted network session (RSA 40-bit RC4 encryption) DES/IPSec tunnel Proprietary encoding 3DES encrypted connection/ SNMP trap support UI Web interface Web interface Microsoft windows interface Web interface
18 Cisco s PIX Firewall Manager POSTECH s Firewall Global Manager Multiple admins. Multiple admins. Yes Event log NT Yes Security, event, traffic log Multiple user login session Yes Linux, Solaris Encryption/ SNMP trap support HTTPS, SSL, IPSec, SNMP Web interface (Java applet) Web interface Most firewall management systems support multiple administrations and multiple simultaneous login sessions. However, Netscreen s Netscreen Global Manager [29] supports only one administrator logging in at a time, and manages the internal firewall devices. Basically, the firewall management systems in this table are managing for the internal firewall devices. Therefore, they use their own proprietary communication protocol. Our FGM uses an open management protocol, SNMP, for managing various firewall devices. The OpenService s SystemWatch [30] has its security agent, which resides on network security devices, such as firewalls, intrusion detection systems (IDS) [32], and virtual private networks (VPN) systems. The SystemWatch security agent plays a central role to monitor and manage security devices by keeping security administrators aware of meaningful activities. The goal of SystemWatch is the same as our FGM for managing multiple security devices. However SystemWatch does not use not an SNMP agent but a proprietary security agent for monitoring. The security agent monitors, manages and responds to critical system events on the security devices based on the pre-configured policies. The management system is based on a 2-tier architecture; that is, a management system does not exist and the Webinterface is a management console. The Cisco s PIX Firewall Manager [31] can manage up to only 10 PIX firewall devices. The PIX Firewall Manager supports a specific configuration of SNMP trap and poll activities. Our FGM can manage thousands of firewall devices and supports not only firewall monitoring, but also firewall configuration globally. VIII. CONCLUSION AND FUTURE WORK Organizations are connected through networks and the Internet is widely used in organizations. The Internet is a public network, so has security risks. The firewalls are generally used for protecting internal networks. For managing various firewalls from a central location, a flexible and secure management server and standard management protocol are also necessary. The SNMP is the standard management protocol, but there is insufficient MIB to manage the firewall configuration. The SNMP also has a security defect.
19 19 JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. XX, NO. Y, DEC Our FGM is based on the same 3-tier Web-based network management architecture and paradigm. But the existing firewall MIB [5] is insufficient to configure firewall configuration. Therefore, we have extended the firewall MIB for firewall configuration and we propose our firewall MIB as a Internet draft. We also presented our design and implementation of an FGM based on the proposed architecture considering security and flexibility. We plan to modify the firewall MIB more generally and apply our SNMP agent to other firewalls and manage these firewalls through our FGM. REFERENCES [1] Steve Steinke, Firewalls, Network Magazine, CommWeb, June [2] D.Brent Chapman, Elizabeth D.Zwicky, Building Internet Firewalls, O Reilly, May [3] William R. Cheswick, Steven M. Bellovin, Firewalls and Internet Security, Addison-Wesley, April [4] J. Case, M. Fedor, M. Schoffstall and C. Davin, The Simple Network Management Protocol (SNMP), RFC 1157, May [5] C. Grall, "Firewall Management Information Base," Internet-Draft, April [6] Hughes, IP Security, Creating Secure Intranets over the Internet, Proc. of INET 96, Montreal, Canada, Spring [7] B. Gleeson, A. Lin, J. Heinanen, G. Armitage, A Framework for IP Based Virtual Private Networks, RFC 2764, February [8] Jim Fitzgerald, CISCO-FIREWALL-MIB, Cisco Systems Inc., December [9] Alan O. Freier, Philip Karlton, The SSL Protocol Version 3.0, Internet Draft, IETF Transport Layer Security WG, November [10] W. Richard Stevens, TCP/IP Illustrated, Volume 1, Addison-Wesley, [11] W3C, Hypertext Transfer Protocol-HTTP/1.1, Internet Draft draft-ietf-http-v11-spec-rev-06, HTTP Working Group, Nov [12] W. Yeong, T. Howes, Lightweight Directory Access Protocol, RFC 1777, March [13] M. Crispin, INTERNET MESSAGE ACCESS PROTOCOL - VERSION 4rev1, Internet Draft, January [14] OpenSSL, [15] Apache-SSL, [16] S. Kent, R. Atkinson, Security Architecture for the Internet Protocol, RFC 2401, November [17] D. Harkins, D. Carrel, The Internet Key Exchange (IKE), RFC 2409, November [18] Cheriton, Greenwald, Singhal, and Stone, Designing an Academic Firewall: Policy, Practice, and Experiences with SURF, Internet Society Symposium on Network and Distributed System Security, San Diego, CA, February [19] K. Hamzeh, G. S. Pall, W. Verthein, J. Taarud, Point to Point Tunneling Protocol (PPTP), Internet Draft, June, [20] J. W. Hong, et. al., Web-based Intranet Services and Network Management, IEEE Communications Magazine, Vol. 35, No. 10, Oct. 1997, pp [21] Blumenthal, Wijnen, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3), RFC2274, January 1998.
20 [22] Hia, H. Erik, Examining How Secured SNMP Network Management Consumes Network Resources, August 2000, [23] Hia, H. Erik, Deploying Secure SNMP in Low Data Rate Networks, July [24] BoradBand Internet Gateway (BIG), A.T.M. Networks, [25] SUN, JAVATM 2 SDK, Standard Edition, [26] UCD-SNMP, [27] WatchGuard, LiveSecurity Control Center, [28] SonicWall, Global Management System, [29] Netscreen, Netscreen Global Manager, [30] OpenService, SystemWatch, [31] Cisco, PIX Firewall Manager, [32] Mark Cooper, An Overview of Intrusion Detection Systems, Xinetica White Paper, Xinetica Ltd., 2000.
Cornerstones of Security
Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known toMore information
SonicWALL PCI 1.1 Implementation Guide
Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS StandardMore information
HP A-IMC Firewall Manager
HP A-IMC Firewall Manager Configuration Guide Part number: 5998-2267 Document version: 6PW101-20110805 Legal and notice information Copyright 2011 Hewlett-Packard Development Company, L.P. No part of thisMore information
Secure Network Design: Designing a DMZ & VPN
Secure Network Design: Designing a DMZ & VPN DMZ : VPN : pet.ece.iisc.ernet.in/chetan/.../vpn- PPTfinal.PPT 1 IT352 Network Security Najwa AlGhamdi Introduction DMZ stands for DeMilitarized Zone. A networkMore information
HP IMC Firewall Manager
HP IMC Firewall Manager Configuration Guide Part number: 5998-2267 Document version: 6PW102-20120420 Legal and notice information Copyright 2012 Hewlett-Packard Development Company, L.P. No part of thisMore information
VPN. Date: 4/15/2004 By: Heena Patel Email:email@example.com
VPN Date: 4/15/2004 By: Heena Patel Email:firstname.lastname@example.com What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintainingMore information
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300 This example explains how to configure pre-shared key based simple IPSec tunnel between NetScreen Remote Client and RN300 VPN Gateway.More information
Case Study for Layer 3 Authentication and Encryption
CHAPTER 2 Case Study for Layer 3 Authentication and Encryption This chapter explains the basic tasks for configuring a multi-service, extranet Virtual Private Network (VPN) between a Cisco Secure VPN ClientMore information
Security Architecture for Development and Run Time Support of Secure Network Applications
Tel: (301) 587-3000 Fax: (301) 587-7877 E-mail: firstname.lastname@example.com Web: www.setecs.com Security Architecture for Development and Run Time Support of Secure Network Applications Sead Muftic, President/CEOMore information
Firewall VPN Router. Quick Installation Guide M73-APO09-380
Firewall VPN Router Quick Installation Guide M73-APO09-380 Firewall VPN Router Overview The Firewall VPN Router provides three 10/100Mbit Ethernet network interface ports which are the Internal/LAN, External/WAN,More information
Chapter 8 Router and Network Management
Chapter 8 Router and Network Management This chapter describes how to use the network management features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. These features can be found byMore information
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-basedMore information
Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )
Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provideMore information
Network Configuration Settings
Network Configuration Settings Many small businesses already have an existing firewall device for their local network when they purchase Microsoft Windows Small Business Server 2003. Often, these devicesMore information
Ranch Networks for Hosted Data Centers
Ranch Networks for Hosted Data Centers Internet Zone RN20 Server Farm DNS Zone DNS Server Farm FTP Zone FTP Server Farm Customer 1 Customer 2 L2 Switch Customer 3 Customer 4 Customer 5 Customer 6 RanchMore information
Exploiting the Web with Tivoli Storage Manager
Exploiting the Web with Tivoli Storage Manager Oxford University ADSM Symposium 29th Sept. - 1st Oct. 1999 Roland Leins, IBM ITSO Center - San Jose email@example.com Agenda The Web Client Concept TivoliMore information
Monitoring Sonic Firewall
Monitoring Sonic Firewall eg Enterprise v6.0 Restricted Rights Legend The information contained in this document is confidential and subject to change without notice. No part of this document may be reproducedMore information
SolarWinds Certified Professional. Exam Preparation Guide
SolarWinds Certified Professional Exam Preparation Guide Introduction The SolarWinds Certified Professional (SCP) exam is designed to test your knowledge of general networking management topics and howMore information
Chapter 12 Supporting Network Address Translation (NAT)
[Previous] [Next] Chapter 12 Supporting Network Address Translation (NAT) About This Chapter Network address translation (NAT) is a protocol that allows a network with private addresses to access informationMore information
Gigabit SSL VPN Security Router
As Internet becomes essential for business, the crucial solution to prevent your Internet connection from failure is to have more than one connection. PLANET is the ideal to help the SMBs increase theMore information
BlackBerry Enterprise Server for Microsoft Exchange Version: 5.0 Service Pack: 2. Feature and Technical Overview
BlackBerry Enterprise Server for Microsoft Exchange Version: 5.0 Service Pack: 2 Feature and Technical Overview Published: 2010-06-16 SWDT305802-1108946-0615123042-001 Contents 1 Overview: BlackBerry EnterpriseMore information
Cisco Which VPN Solution is Right for You?
Table of Contents Which VPN Solution is Right for You?...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 NAT...2 Generic Routing Encapsulation Tunneling...2More information
Monitoring Remote Access VPN Services
CHAPTER 5 A remote access service (RAS) VPN secures connections for remote users, such as mobile users or telecommuters. RAS VPN monitoring provides all of the most important indicators of cluster, concentrator,More information
NETWORK DEVICES MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS can monitor all the network devices available in the market, like Routers, Switches, Modems, Access points,More information
Lecture 10: Virtual LANs (VLAN) and Virtual Private Networks (VPN)
Lecture 10: Virtual LANs (VLAN) and Virtual Private Networks (VPN) Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG 4185 10-1 Virtual LANs Description: Group of devicesMore information
Network-Enabled Devices, AOS v.5.x.x. Content and Purpose of This Guide...1 User Management...2 Types of user accounts2
Contents Introduction--1 Content and Purpose of This Guide...........................1 User Management.........................................2 Types of user accounts2 Security--3 Security Features.........................................3More information
Enterprise Security Management CheckPoint SecuRemote VPN v4.0 for pcanywhere
Enterprise Security Management CheckPoint SecuRemote VPN v4.0 for pcanywhere White Paper 7KH#&KDOOHQJH Virtual Private Networks (VPNs) provides a powerful means of protecting the privacy and integrityMore information
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry EnterpriseMore information
Configuring and Monitoring Citrix Branch Repeater
Configuring and Monitoring Citrix Branch Repeater eg Enterprise v5.6 Restricted Rights Legend The information contained in this document is confidential and subject to change without notice. No part ofMore information
Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer
Other VPNs TLS/SSL, PPTP, L2TP Advanced Computer Networks SS2005 Jürgen Häuselhofer Overview Introduction to VPNs Why using VPNs What are VPNs VPN technologies... TLS/SSL Layer 2 VPNs (PPTP, L2TP, L2TP/IPSec)More information
Configuration Guide. BlackBerry Enterprise Service 12. Version 12.0
Configuration Guide BlackBerry Enterprise Service 12 Version 12.0 Published: 2014-12-19 SWD-20141219132902639 Contents Introduction... 7 About this guide...7 What is BES12?...7 Key features of BES12...More information
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encryptsMore information
SNMP Monitoring and SWG MIB
SNMP Monitoring and SWG MIB Secure Web Gateway Release 10.0 Manual Version 1.01 M86 SECURITY SNMP MONITORING AND SWG MIB 2010 M86 Security All rights reserved. 828 W. Taft Ave., Orange, CA 92865, USA VersionMore information
NEFSIS TRAINING SERIES Nefsis Dedicated Server version 5.2.0.XXX (DRAFT Document) Requirements and Implementation Guide (Rev5-113009) REQUIREMENTS AND INSTALLATION OF THE NEFSIS DEDICATED SERVER NefsisMore information
Clientless SSL VPN Users
Manage Passwords, page 1 Username and Password Requirements, page 3 Communicate Security Tips, page 3 Configure Remote Systems to Use Clientless SSL VPN Features, page 3 Manage Passwords Optionally, youMore information
RemotelyAnywhere Getting Started Guide
April 2007 About RemotelyAnywhere... 2 About RemotelyAnywhere... 2 About this Guide... 2 Installation of RemotelyAnywhere... 2 Software Activation...3 Accessing RemotelyAnywhere... 4 About Dynamic IP Addresses...More information
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds firstname.lastname@example.com What is Firewall? A firewallMore information
Application Note. Using a Windows NT Domain / Active Directory for User Authentication NetScreen Devices 8/15/02 Jay Ratford Version 1.
Application Note Using a Windows NT Domain / Active Directory for User Authentication NetScreen Devices 8/15/02 Jay Ratford Version 1.0 Page 1 Controlling Access to Large Numbers of Networks Devices toMore information
Scenario: IPsec Remote-Access VPN Configuration
CHAPTER 3 Scenario: IPsec Remote-Access VPN Configuration This chapter describes how to use the security appliance to accept remote-access IPsec VPN connections. A remote-access VPN enables you to createMore information
NMS300 Network Management System
NMS300 Network Management System User Manual June 2013 202-11289-01 350 East Plumeria Drive San Jose, CA 95134 USA Support Thank you for purchasing this NETGEAR product. After installing your device, locateMore information
We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,More information
Technical papers Virtual private networks
Technical papers Virtual private networks This document has now been archived Virtual private networks Contents Introduction What is a VPN? What does the term virtual private network really mean? WhatMore information
Novell Access Manager SSL Virtual Private Network
White Paper www.novell.com Novell Access Manager SSL Virtual Private Network Access Control Policy Enforcement Compliance Assurance 2 Contents Novell SSL VPN... 4 Product Overview... 4 Identity Server...More information
SANGFOR SSL VPN. Quick Start Guide
SANGFOR SSL VPN Quick Start Guide This document is intended to assist users to install, debug, configure and maintain SANGFOR SSL VPN device quickly and efficiently. Please read the followings carefullyMore information
NETWORK DEVICE MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS is able to monitor all network devices available on the marke such as Routers, Switches, Modems, Access points,More information
Chapter 4 Firewall Protection and Content Filtering
Chapter 4 Firewall Protection and Content Filtering This chapter describes how to use the content filtering features of the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN to protect your network.More information
Barracuda Link Balancer Administrator s Guide
Barracuda Link Balancer Administrator s Guide Version 1.0 Barracuda Networks Inc. 3175 S. Winchester Blvd. Campbell, CA 95008 http://www.barracuda.com Copyright Notice Copyright 2008, Barracuda NetworksMore information
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 withMore information
Chapter 9 Monitoring System Performance
Chapter 9 Monitoring System Performance This chapter describes the full set of system monitoring features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. You can be alerted to importantMore information
Multi-Homing Dual WAN Firewall Router
Multi-Homing Dual WAN Firewall Router Quick Installation Guide M73-APO09-400 Multi-Homing Dual WAN Firewall Router Overview The Multi-Homing Dual WAN Firewall Router provides three 10/100Mbit EthernetMore information
Configuration Guide BES12. Version 12.2
Configuration Guide BES12 Version 12.2 Published: 2015-07-07 SWD-20150630131852557 Contents About this guide... 8 Getting started... 9 Administrator permissions you need to configure BES12... 9 ObtainingMore information
Avaya TM G700 Media Gateway Security. White Paper
Avaya TM G700 Media Gateway Security White Paper March 2002 G700 Media Gateway Security Summary With the Avaya G700 Media Gateway controlled by the Avaya S8300 or S8700 Media Servers, many of the traditionalMore information
Avaya G700 Media Gateway Security - Issue 1.0
Avaya G700 Media Gateway Security - Issue 1.0 Avaya G700 Media Gateway Security With the Avaya G700 Media Gateway controlled by the Avaya S8300 or S8700 Media Servers, many of the traditional EnterpriseMore information
Network Security and Firewall 1
Department/program: Networking Course Code: CPT 224 Contact Hours: 96 Subject/Course WEB Access & Network Security: Theoretical: 2 Hours/week Year Two Semester: Two Prerequisite: NET304 Practical: 4 Hours/weekMore information
Barracuda Link Balancer
Barracuda Networks Technical Documentation Barracuda Link Balancer Administrator s Guide Version 2.2 RECLAIM YOUR NETWORK Copyright Notice Copyright 2004-2011, Barracuda Networks www.barracuda.com v2.2-110503-01-0503More information
Chapter 4 Firewall Protection and Content Filtering
Chapter 4 Firewall Protection and Content Filtering The ProSafe VPN Firewall 50 provides you with Web content filtering options such as Block Sites and Keyword Blocking. Parents and network administratorsMore information
83-10-44 DATA SECURITY MANAGEMENT PROTECTING NETWORKS WITH FIREWALLS Gilbert Held INSIDE Connecting to the Internet; Router Packet Filtering; Firewalls; Address Hiding; Proxy Services; Authentication;More information
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished inMore information
External Authentication with Cisco VPN 3000 Concentrator Authenticating Users Using SecurAccess Server by SecurEnvoy
External Authentication with Cisco VPN 3000 Concentrator Authenticating Users Using SecurAccess Server by SecurEnvoy Contact information SecurEnvoy www.securenvoy.com 0845 2600010 1210 Parkview ArlingtonMore information
Configuring and Monitoring Hitachi SAN Servers
Configuring and Monitoring Hitachi SAN Servers eg Enterprise v5.6 Restricted Rights Legend The information contained in this document is confidential and subject to change without notice. No part of thisMore information
S y s t e m A r c h i t e c t u r e
S y s t e m A r c h i t e c t u r e V e r s i o n 5. 0 Page 1 Enterprise etime automates and streamlines the management, collection, and distribution of employee hours, and eliminates the use of manualMore information
SyncThru TM Web Admin Service Administrator Manual
SyncThru TM Web Admin Service Administrator Manual 2007 Samsung Electronics Co., Ltd. All rights reserved. This administrator's guide is provided for information purposes only. All information includedMore information
SonicWALL Global Management System ViewPoint Guide. Version 2.1
SonicWALL Global Management System ViewPoint Guide Version 2.1 Copyright Information 2001 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software described within, mayMore information
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications betweenMore information
SonicWALL Global Management System Reporting Guide Standard Edition
SonicWALL Global Management System Reporting Guide Standard Edition Version 2.8 Copyright Information 2004 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software describedMore information
Interwise Connect. Working with Reverse Proxy Version 7.x
Working with Reverse Proxy Version 7.x Table of Contents BACKGROUND...3 Single Sign On (SSO)... 3 Interwise Connect... 3 INTERWISE CONNECT WORKING WITH REVERSE PROXY...4 Architecture... 4 Interwise WebMore information
DEPLOYMENT GUIDE Version 1.0. Deploying the BIG-IP Edge Gateway for Layered Security and Acceleration Services
DEPLOYMENT GUIDE Version 1.0 Deploying the BIG-IP Edge Gateway for Layered Security and Acceleration Services Table of Contents Table of Contents Using the BIG-IP Edge Gateway for layered security andMore information
Integrated Management System Job Management Partner 1 (JP1), Version6i for Broadband Networks
Hitachi Review Vol. 51 (2002), No. 2 65 Integrated Management System Job Management Partner 1 (JP1), Version6i for Broadband Networks Yoshiyuki Kurosaki Toshio Sato Kiminori Sugauchi Tokuji Tamada OVERVIEW:More information
SonicWALL Global Management System Configuration Guide Standard Edition
SonicWALL Global Management System Configuration Guide Standard Edition Version 2.3 Copyright Information 2002 SonicWALL, Inc. All rights reserved. Under copyright laws, this manual or the software describedMore information
Initial Access and Basic IPv4 Internet Configuration
Initial Access and Basic IPv4 Internet Configuration This quick start guide provides initial and basic Internet (WAN) configuration information for the ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318NMore information
Configuration Guide BES12. Version 12.1
Configuration Guide BES12 Version 12.1 Published: 2015-04-22 SWD-20150422113638568 Contents Introduction... 7 About this guide...7 What is BES12?...7 Key features of BES12... 8 Product documentation...More information
a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a fileMore information
IPSec, VPN, and Firewall Concepts
APPENDIX B This appendix introduces the concepts of Internet Security Protocol (IPSec), virtual private networks (VPNs), and firewalls, as they apply to monitoring with Performance Monitor: Overview: IPSecMore information
Cisco Secure Access Control Server 4.2 for Windows
Cisco Secure Access Control Server 4.2 for Windows Overview Q. What is Cisco Secure Access Control Server (ACS)? A. Cisco Secure ACS is a highly scalable, high-performance access control server that operatesMore information
DATA SECURITY 1/12. Copyright Nokia Corporation 2002. All rights reserved. Ver. 1.0
DATA SECURITY 1/12 Copyright Nokia Corporation 2002. All rights reserved. Ver. 1.0 Contents 1. INTRODUCTION... 3 2. REMOTE ACCESS ARCHITECTURES... 3 2.1 DIAL-UP MODEM ACCESS... 3 2.2 SECURE INTERNET ACCESSMore information
GlobalSCAPE DMZ Gateway, v1. User Guide
GlobalSCAPE DMZ Gateway, v1 User Guide GlobalSCAPE, Inc. (GSB) Address: 4500 Lockhill-Selma Road, Suite 150 San Antonio, TX (USA) 78249 Sales: (210) 308-8267 Sales (Toll Free): (800) 290-5054 TechnicalMore information
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutionsMore information
Multi-Homing Security Gateway
Multi-Homing Security Gateway MH-5000 Quick Installation Guide 1 Before You Begin It s best to use a computer with an Ethernet adapter for configuring the MH-5000. The default IP address for the MH-5000More information
SonicWALL Global Management System Reporting Guide Standard Edition
SonicWALL Global Management System Reporting Guide Standard Edition Version 2.9.4 Copyright Information 2005 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software describedMore information
Astaro Security Gateway V8. Remote Access via SSL Configuring ASG and Client
Astaro Security Gateway V8 Remote Access via SSL Configuring ASG and Client 1. Introduction This guide contains complementary information on the Administration Guide and the Online Help. If you are notMore information
A Model Design of Network Security for Private and Public Data Transmission
2011, TextRoad Publication ISSN 2090-424X Journal of Basic and Applied Scientific Research www.textroad.com A Model Design of Network Security for Private and Public Data Transmission Farhan Pervez, AliMore information
Chapter 8 Monitoring and Logging
Chapter 8 Monitoring and Logging This chapter describes the SSL VPN Concentrator status information, logging, alerting and reporting features. It describes: SSL VPN Concentrator Status Active Users EventMore information
About Firewall Protection
1. This guide describes how to configure basic firewall rules in the UTM to protect your network. The firewall then can provide secure, encrypted communications between your local network and a remoteMore information
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. riskMore information
Cisco RV082 Dual WAN VPN Router Cisco Small Business Routers
Cisco RV082 Dual WAN VPN Router Cisco Small Business Routers Secure Remote Access at the Heart of the Small Business Network Highlights Dual WAN connections for load balancing and connection redundancyMore information
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Course Description: Introduction to Cybersecurity is designed to provide students the basic concepts and terminologyMore information
1 SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP) Mohammad S. Hasan Agenda 2 Looking at Today What is a management protocol and why is it needed Addressing a variable within SNMP Differing versions Ad-hoc NetworkMore information
Lab 8.4.2 Configuring Access Policies and DMZ Settings
Lab 8.4.2 Configuring Access Policies and DMZ Settings Objectives Log in to a multi-function device and view security settings. Set up Internet access policies based on IP address and application. SetMore information
Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1
Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1 This document describes how to configure an IPSec tunnel between a WatchGuard Firebox Vclass appliance (Vcontroller versionMore information
Vantage Report. User s Guide. www.zyxel.com. Version 3.0 10/2006 Edition 1
Vantage Report User s Guide Version 3.0 10/2006 Edition 1 www.zyxel.com About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to configure the VantageMore information
Total solution for your network security. Provide policy-based firewall on scheduled time. Prevent many known DoS and DDoS attack
Network Security Total solution for your network security With the growth of the Internet, malicious attacks are happening every minute, and intruders are trying to access your network, using expensiveMore information
Firewalls. Ahmad Almulhem March 10, 2012
Firewalls Ahmad Almulhem March 10, 2012 1 Outline Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Configurations Firewall Policies and Anomalies 2More information
For the protocol access paths listed in the following table, the Sentry firmware actively listens on server ports to provide security for the CDU.
CDU Security This provides a quick reference for access paths to Server Technology s Cabinet Distribution Unit (CDU) products, shows if the access path is secure, and if so, provides an overview of howMore information
CSS HARDWARE LOAD BALANCING POLICY Version 2.5 Date: 04/11/2014 SECURITY WARNING The information contained herein is proprietary to the Commonwealth of Pennsylvania and must not be disclosed to un-authorizedMore information
redcoal EmailSMS for MS Outlook and Lotus Notes
redcoal EmailSMS for MS Outlook and Lotus Notes Technical Support: email@example.com Or visit http://www.redcoal.com/ All Documents prepared or furnished by redcoal Pty Ltd remains the property of redcoalMore information
Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1
Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1 This document describes how to configure an IPSec tunnel with a WatchGuard Firebox II or Firebox III (software version 4.5 or later)More information
DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12
DEPLOYMENT GUIDE Version 1.2 Deploying F5 with Oracle E-Business Suite 12 Table of Contents Table of Contents Introducing the BIG-IP LTM Oracle E-Business Suite 12 configuration Prerequisites and configurationMore information
Volume SYSLOG JUNCTION. User s Guide. User s Guide
Volume 1 SYSLOG JUNCTION User s Guide User s Guide SYSLOG JUNCTION USER S GUIDE Introduction I n simple terms, Syslog junction is a log viewer with graphing capabilities. It can receive syslog messagesMore information
nappliance misa Server 2006 Standard Edition Users Guide For use with misa Appliances 2006 nappliance Networks, Inc.
nappliance misa Server 2006 Standard Edition Users Guide For use with misa Appliances The information contained in this document represents the current view of Microsoft Corporation on the issues discussedMore information
WhatsUp Gold v11 Features Overview
WhatsUp Gold v11 Features Overview This guide provides an overview of the core functionality of WhatsUp Gold v11, and introduces interesting features and processes that help users maximize productivityMore information


text:
Although I had this epic critical against a goblin minion (It was a triple hit combo that ended with neck breaker!!!) I kinda bit the bullet and got owned by their boss...And this is when I was lv1...and you know how bad monks are at lv1....or maybe I just didn't use the right strategy.
Anyway I got owned, bad
My first character was a Dwarven Fighter/Mage.
Good stats, but weird character. I kept making him to random stuff, because he was a total loony.
Edit: Also, I just remembered: it wasn't just that. Secretly, I was trying to get him killed, so that I could make a different character. One that would be more suitable for the political air-based campaign we were on.
Last edited by Epsilon7; 03-16-2012 at 04:55 PM.
First character I ever made was an elf I called Retton. This was back in the days of the blue and red boxed sets. I can remember some of the module names such "Keep on the Borderlands", "Sinister Secret of Saltmarsh" and, "Isle of Dread."
First 2nd edition character I made was a wizard. I was the new guy in the group, everyone else had been in a campaigns together and they'd just started playing 2e. I played my wizard as brand new to the world of adventuring, because he was 1st level, straight up out of wizard school. After defeating a large number of orcs or some similar creatures, we went through the loot and the only thing usable by a wizard was...a scroll with 1 use of Dancing Lights.
I spent the rest of the game session having my character go and on about how fantastic it was that we were adventurers that could gain such powerful magic. No one else seemed impressed, I think it was because they figured if we played long enough, we'd get vorpal swords and a staff of power.
All these years later, currently in a pathfinder game with my tabletop group, I make sure to use Dancing Lights when I can, and extol the virtues of what is clearly one of the most powerful spells ever.
First 3e character was a cleric. He couldn't hit anything with his mace. Ever. Most damage he ever did, or a least the most memorable damage, was when a botched ride check led to him (and his plate mail) launching off his horse and onto somebdoy. Not the intended way of entering a combat, not at all.
"Enjoy every sandwich." - WZ
Blue box also- probably around 1979. Some run of the mill dwarven fighter, name lost to time. That's all I played for my first year or so. First AD&D character was a thief who got busted for pickocketing and lost his right hand as punishment. Luckily he was left-handed.
The character itself was also garbage because I was 11 or 12 at the time and thought that playing a Mary Sue was an amazing idea! *le sigh*
The character was originally made with 1st ed and shifted to 2nd ed about half way into his career.
The important part is though...
Many years later I remade the character for a one shot to be played on a week long vacation gaming bender that was run by a friend of mine. The system was Palladium fantasy and I was like 15 at the time, so I gave him some Vampire Hunter D likeness this time around, though the character ended up playing drastically different personality wise.
The game was amazing and was one of the most of fun and original things I had played. I liked it so much that myself and others have since GMed it, and it now has it's own wiki I maintain that is linked in my signature.
The world itself is massively fun for me, and the remake of the character is still my favorite (though I have several close seconds).
To this day I still run active games for this setting (it's my favorite fantasy setting by far) but now I use GURPS 4e instead of Palladium.
Lord Arid Von Audrite
He ended up becoming a ridiculously over powered wizard and is now an NPC of mythical proportions and a legend in his country of origin.
I wish I could tell the tale of the character but the truth is, I have in that wiki, and it's not at all short.
Technically he's still out there fighting the unseen evils, but he's very much removed from the typical world so as to make sure moderns PCs have a chance to shine. It's the same logic that applies to why Superman isn't allowed in Gotham.
Quick Start Advice | PBP GM Academy | New Member Guide | Player Guide | GM Guide
Become CS! | WoLT Game Wiki | AKK
Pathfinder Player/GM? Join the team at Eternity's End
Last edited by WoLT; 04-14-2012 at 05:17 AM.
Mine was the very definition of trying too hard to be edgy. It was 1st Edition. I had just checked out all the supplemental materials, and had become fascinated by the concept of "Lawful Evil". So I made a half-orc cleric/assassin (remember, this was AD&D so only half-orcs could become that particular combination) who worshiped Asmodeus. He didn't last very long (thankfully, in hindsight) since the DM got 3rd edition books soon after that and I made a more normal character when we started on 3rd (gnome illusionist, I believe).
Do you suffer from a lack of giant robots, heroic warriors, talking animals, and the power of friendship?
Then run with us...
My first character was an Elf Cleric named Vahn Ferrer, Ferrer of course being taken from the tennis player David Ferrer though I have no idea why. He was quite the unlucky soul. Almost dying in his very first dungeon, being made a barricade for a door only to be trampled on, even being given a Cursed Mace +1 and having his connection with his deity cut. Oh that was fun, fighting a succubus and her rather ridiculous bodyguard without healing or Good Aligned spells.
He never made it through the rest of the campaign, though only because the school year had ended and it was time to return home.
My very first character came from a d10 system for the 7th Sea rpg. I played a very Robin-Hood-esque youth (whose name escapes me at the moment). He was very much a woodland type of person from the kingdom of Avalon which was based on Great Britain. I was only 14 and very new to gaming. I was very careful to try not to stand out, but the story teller of that group decided I needed a push into the cold water of roleplaying.
My character was entrusted by the group to deliver a very important parcel to an unknown person in a "house of pleasure." No big deal right?
Storyteller: You walk into the brothel. It's very busy tonight with many well-to-do patrons who turn their nose up at you. Hoping to rid you quickly the matron of the house rushes over to try to shoo you out the door."
Me: I'm looking for a man...I have a package for him.
The table erupted in laughter and once I realized what I had said the ice was broken. This tale is still told at the local gaming store where I will apparently go down in infamy.
Elf Paladin...I totally didn't know how to make a good character at all. Kept putting the skill points in random skills, got weird feats that didn't help, then some goblins shot him with crossbows and he died.
LN Elven Diviner, was all about learning and was arrogant as hell. Once just waltzed into an obviously trapped room that the rest of the party avoided. Amazed he didn't die. My tactics were worthless and the party disliked him.
Tuzon Thume
My older sister's friend Jonathon helped me make my first character in the summer of 1979. I was reading Karl Edward Wagner at the time as well as Robert E. Howard, Tolkein, Burroughs & most certainly Robert Aspirin's Thieves World books. I made me a megalomaniac Bilbo Baggins; 3d6 in order rolled for a 2e campaign we never started. A year later Tuzon & I joined a game with two friends. They decided the halfling thief was doomed from the start and allowed me to also play a Fafhrd for my Grey Mouser. Kuralt, a half-Ogre fighter was Tuzon's bodyguard & business partner in The City State of the Invincible Overlord . Tuzon survives to this day in a 4th edition incarnation in Zeppo007's solo game and has never been below 1hp.[he's at your mercy Zeppo007] Tuzon was always been at the forefront of cash gathering; his favorite mark is the payroll of a despotic rulers' military. Occasionally he has become a hero of the indigent & helpless though he always expects a favor in exchange for his generosity. He has also dabbled in assassination, unafraid to use poisons to get the job done.
Nulla tenaci invia est via
My first character....I never even got to play him. He was a paladin (I can't remember his name, but he had a shield named "Dexter" and a sword named "Sinister"). A guy at school who was into D&D rolled him up and sort of explained what everything meant. He emphasized that the paladin needed a high CHA so that he could get lots of followers. He insisted that the character's sword had been stripped off a dead body (I wanted it to be an heirloom). When my mom found out, she freaked, and it would be awhile before I got interested enough again to actually purchase the game.
Barivus "The Fearless" Verilius: tiefling fighter, worshiper of Hextor, murderer, thief, villain.
He was my first character, it was college, and I got to be a pirate. My back story was epic. Single mother parent, never knew his roaming, warlord, half-demon father. He had a troubled youth and left home to find his dad. I started at level seven, and died twice. The first death was battling a destrachan. I think it was a destrachan. The second death was punishment for harrassing the DM to allow me to purchase a lemur. He had killed the first one to punish my poor choices. I had harrassed him for the first one as well. I never got a second one. I was raised after both deaths, but the game became hard to schedule the following semester and eventually the DM gave up working trying to get sessions in after falling to less than every other week.
New? Try a New Player Solo Game!
Adventures in Greyhawk
Happy Holidays Everyone! Please excuse my delayed responses as work and family obligations take over my all ready busy schedule.
My first character was a lvl 1 human fighter. With a party of adventurers and 3 members of the town guard we were given the task to hunt down an Ankheg. Our plan was to trap it and torch it, but when we torched it, the net burnt as well. High up in the trees we gave him everything we've got, but soon we ran out of oil flasks and only half the party had ranged weapons. I threw my spear, missed and realized it was my only weapon. So I jumped down from my safe place in the tree and took my spear from the ground to stab it. I missed, but the ankheg didn't, killing me with a single bite. Two of the guards and 2 other partymembers died in the same encounter because nobody followed the initial plan. One of those who survived was the bait to lure the ankheg in our trap. We all learned a couple of valuable lessons that day.
My first character... Drumm the Dwarf. He was a fighter, and none too bright. He forgot to let go of the cask of burning oil when tossing it at enemies.
|Thread Tools

subset: commoncrawl


text:
Verizon and Apple are discussing the possible development of an iPhone for Verizon, with the goal of introducing it next year, people familiar with the situation say.
It would mark the first time Apple has produced a version of the iPhone for a CDMA wireless network, which is different from AT&T's GSM technology. Vodafone, co-owner of Verizon Wireless, already sells the iPhone in Europe.
The New York-based telecom entered into "high-level" discussions with Apple management a few months ago, when CEO Steve Jobs was overseeing day-to-day business, these sources say. They declined to be named because they aren't authorized to speak publicly.
Jobs is on medical leave until June, but the conversations are continuing, they say. Apple declined to comment.
AT&T has exclusive U.S. distribution rights to the iPhone into 2010, though specifics aren't known. The deal was struck in 2006, when the iPhone was still on the drawing board. Many telecom analysts expect AT&T to try to persuade Apple to extend the contract for another year, at least.
Should Verizon succeed, it would be a big loss for AT&T, says Roger Entner, head of telecom research for Nielsen. "Breaking the (iPhone) exclusivity with AT&T is a huge thing," he says. "That would send shivers into AT&T's stock and senior leadership."
The power of the iPhone was on full display last week, when AT&T reported stellar wireless results. AT&T signed up 1.6 million iPhone customers during the quarter – 40 percent of them new to AT&T. Revenue from mobile data was up almost 40 percent. Verizon reports results today.
By linking arms with Verizon, Entner says, Apple would gain access to its 80 million customers. While a few may already have an iPhone (some people have more than one carrier), the bulk don't.
Regardless, Entner says, Apple would likely maintain ties with AT&T. The biggest winners, by far, would be consumers, he says.
"They could pick the network they wanted to use: AT&T's or Verizon's," he says. "It would finally give consumers choice, and choice is a good thing."
Entner says Verizon would fare well in that fight. While AT&T's 3G network is "somewhat faster," he says, Verizon's network "is generally perceived to be better in terms of reliability."
The biggest loser? "AT&T," Entner says. "It would be a reversal of fortune, because a lot of people who have been disappointed in AT&T's network but love the iPhone would probably" jump to Verizon.
Apple would also benefit, he adds, "because that means they'd have to buy a new iPhone."


text:
Your session will expire in seconds.Do you want to stay connected?
Welcome to Silverfish. This site uses cookies. Read our policy.
Formula RO Disc Brakes
The RO is the first mass production bicycle brake to use oval caliper pistons. This simple idea created a brake with more power than four piston brakes while maintaining the reliability and weight of a two piston brake. This year we updated the RO to the standard Formula radial master cylinder. This master cylinder makes the RO more compact and lighter than ever before.
Proven ECT (Enhanced Caliper Technology)
Master Cylinder
Silverfish UK Ltd. Units 3a-3c Woodacre Court, Saltash Parkway Industrial Estate, Burraton Road, Saltash, Cornwall, United Kingdom, PL12 6LY
Silverfish UK Ltd. (Registration No. 4075057).
Technical specifications are for guidance only and cannot be guaranteed accurate. All offers are subject to availability and while stocks last. Errors and omissions excepted. Silverfish UK Limited acts as a credit intermediary and only offers credit products for Close Brothers Retail Finance. Its registered office is: Close Brothers Group plc, 10 Crown Place, London EC2A 4FT. Credit is subject to application and status.


text:
Sunday, 07 August 2011 06:25 AM
(Updates with statement)
* U.S. rating cut won't deter S.Korea economic growth -vice
fin minister
* S.Korea's trust in U.S. Treasures has not changed
SEOUL, Aug 7 (Reuters) - South Korean policymakers on Sunday
played down any likely impact on the economy following the
downgrade in U.S. credit ratings and told local investors not to
panic when financial markets reopen.
Global policymakers held an emergency conference call on
Sunday to discuss the twin debt crises in Europe and the United
States that are causing market turmoil and stoking fears of the
rich world sliding back into recession.
"It (the Standard and Poor's cut in the U.S. credit rating)
will have a limited impact on our economy, thus our judgement is
that local financial markets do not need to overreact to it,"
Vice Finance Minister Yim Jong-yong told a briefing after an
emergency economic meeting.
He said the U.S. rating cut would not derail the current
growth pattern in the export-led economy, considering its
reduced dependence on U.S. and European markets and resilient
industrial output and employment data.
The emergency meeting, attended by senior officials from the
finance ministry, Bank of Korea and the financial watchdog and a
financial regulator, came before the Bank of Korea reviews its
policy rate on Thursday.
Officials agreed to discuss measures if needed, Yim added.
Meanwhile, the government will continue to put policy
priority on fighting inflation and will not change its macro
economic policies, the ministry said in a statement.
Separately, Deputy Finance Minister Choi Jong-ku told
Reuters that South Korea's trust in U.S. Treasuries has not
changed, after a conference call with other G20 finance
"I expressed our country's position at the call that there
will be no sudden change in our reserve management policy," Choi
said, referring to the heavy weighting of U.S. bonds in the
country's more than $300 billion in foreign reserves.
"There's no alternative (to U.S. government bonds) that
provides such stability and liquidity," he added, declining to
elaborate on the G20 discussion.
(Reporting by Kim Yeonhee and Yoo Choonsik, editing by Jonathan
© 2018 Thomson/Reuters. All rights reserved.
Newsmax Comment Policy
Keep discussions on topic, avoid personal attacks and threats of any kind. Links will not be permitted.
Newsmax, Moneynews, Newsmax Health, and Independent. American. are registered trademarks of Newsmax Media, Inc. Newsmax TV, and Newsmax World are trademarks of Newsmax Media, Inc.


text:
"Palazzo Senatorio" submitted by RomeTour Editorial Team and last updated on Sunday 26th June 2011
Palazzo Senatorio (Town Council) is the central palace in Piazza del Campidogio. Its name derives from the fact that it was a seat of Roman Senate till 1870, when became the official seat of Comune di Roma and the Mayor of Rome. On the remains of the ancient Tabularium in the 11th century was built a fortress by the Corsi, and the Senate was probably installed here in 1143. The medieval castle with four towers was renewed in the 13th-14th centuries, and redesigned by Michelangelo in the 16th century. The present aspect of the palace is a modification of Michelanelo's design by G.Della Porta in 1582-1606.
In front of the double stair-case, with converging flights, is a fountain with two colossal statues (2nd century A.D.) of the Tiber (right) and Nile (left) coming from the Baths of Constantine in Quirinal Hill; in the recess is a porphyry statue of Minerva, Dea Roma (Goddess of Rome). The palace is crowned by a bell-tower, projected by M.Longhi in 1578-1582, with a clock, a statue of Minerva, and a gilded cross; two bells (1803-1804) replace the famous major bell called Patarina, which has been installed in 1200 to summon the people to "Parlamento". In 1827-1935 this bell-tower housed an Astronomic Observatory, which now is located on Monte Mario.
Council Chamber (with a statue of Julius Caesar), Sala delle Bandiere (Hall of the Flags), Sala della Protomoteca (with large collection of busts of famous people picked by Pius VII), Great Hall.
Tabularium (pictured below), or depository of the State archives, its great blocks of porous tufa built into the unhewn rock dominate the view of the hill from the Forum, erected in 78 b.C..
Michelangelo also designed a monumental double-flighted staircase for the Palazzo Senatorio, in addition to dividing up the façade with gigantic pilaster strips, large windows and tympanums and a crowning balustrade featuring statues. The work was completed after his death by Giacomo della Porta, who made some alterations to Michelangelo's plan. The bell-tower was also the result of an alteration to the original plan, this time by Martino Longhi the Elder.
Originally it was a building with at least two floors and eight arches facing the Forum. Still existing staircase connected it with the level of Forum. The vast hall on the first floor in the Middle Ages was used as a store of sole and a prison.
The entrance to Palazzo Senatorio (Town Council) is in Piazza del Campidoglio at the corner with via S.Pietro in Carcere. The tour includes the Studio and the blue salon of the Mayor with a view on the Forum, the Hall of the Tapestries, the Hall of the Banners, the Julius Caesar hall, seat of the city council, and the Collection of busts. From here, through the portico by Vignola, you enter the Picture Gallery and the Roman Garden with the Exedra of Marcus Aurelius. Handicapped visitors can use the lift of the Tabularium (entrance in via di San Pietro in Carcere) to reach the first floor of the Palazzo Senatorio, and they will follow the other visitors. No booking is needed.
Palazzo Senatorio (Town Council)
Piazza del Campidoglio, 1 (Via del Tempio di Giove)
00186 , Rome, Lazio, Italy
Zone: Rione Campitelli (Foro Romano- Campidoglio-P.Venezia) (Roma centro)
Palazzo Senatorio (Town Council) is Shown By "Map K Zone" As "2"
Hours: Guided tours: from 10 Dec 2006 to 2 Dec 2007 every first Sunday of the month 9am-1pm. Entrance for groups of max 30 people every 10/15 minutes.
Telephone: 0039 06 69941531/2/3/4 - 67103898/9
Fax: 0039 06 67103590


text:
Kate Clinton to Sage The White House....:)
Kate Clinton has a perfect event coming up on January 19th. It's to Sage the White House after Bush's 8 years of ruinous residency. Just as the priests & shamans were called in to sage Machu Picchu after George Bush's ten minute "So You Think You Can Dance" visit to the ruins, she says, "Let's banish those evil spirits the night before the Inauguration of Barack Obama." In our exclusive audio-interview @ OUTTAKE VOICES™ Kate gives her honest & hilarious opinions of the state of our country & the future of our LGBT community. Check it OUT...:)
View Our Short Trailer on Gay Marriage
View Our Short Trailer on Gay Marriage
Labels: Gay Marriage, Kate Clinton, LGBT Civil Rights, Prop 8


text:
I love to support companies that are passionate, inclusive of the plus-size community and beauty ranges that are cruelty free.
I write all of my reviews honestly and take all of my own photos of the products that I use. I tailor my writing style to my audience but I always stay true to who I am. If you're a brand that's looking for PR opportunities for your own product and you want an honest review with true life photography and an engaged reader base, I'm your girl.
I'll denote any posts I write reviews of gifted products with the line **This review was of a gifted item for review by the brand in question – all views are my own.** so that my reader base knows of the opportunity you have given to me.
I'm really excited about new trends, especially anything that is created with the plus-size community in mind.
If you'd like to contact me about reviewing your product or collaborating on a project, you can do by emailing me at firstname.lastname@example.com or by using the Contact Me form on my site.


text:
Better be busy whittlin' or have that lathe spinning. The Rock Candy 500 pinewood derby is just around the corner. On Thursday, April 9, from 7 p.m. until 9 p.m., we'll race homemade derby cars on a 40-foot track on loan from the Boy Scouts. Prizes will be awarded for speed, paint, design, best kid's entry (under 14) and best of show. The entry fee is $8 in advance or $10 the day of the race. You'll find an entry form on page 14 of this issue. All proceeds benefit Boy Scout Troop 5, chartered by Easter Seals Arkansas. Find a complete list of rules, addresses and phone numbers for local outlets to buy derby kits and more on Rock Candy.
Somewhat surprisingly, there are still some 1,500 tickets available for the September 29 Dave Matthews Band concert at Dickey-Stephens, via the Travs' box office, according to general manager Pete Laven. Tickets are $55-$65.
The Coen brothers have bumped their adaptation of Charles Portis' "True Grit" into the batter's box, ahead of projects like an adaptation of Michael Chabon's "Yiddish Policemen's Union."
Arkansas film commissioner Christopher Crane says the brothers haven't decided where they're filming and that Arkansas could be in the running if the Arkansas film incentive packag, is signed into law.
Now that the state legislature has officially deemed a stretch of US 67 as "Rock 'n' Roll Highway 67," it's time for the ledge to move on to other insignificant-but-fun-to-talk-about matters. Namely, following Oklahoma's lead and designating an official "rock song" for Arkansas. The Flaming Lips' "Do You Realize?" recently earned that title in Oklahoma.
I've gotten the ball rolling online and nominated Black Oak Arkansas's "Hot and Nasty." Join in on the blog.
Watch "Dear Daniel," the new stop-motion music video from the Good Fear. The band's lead singer Zach Holland teamed with local photographer Rett Peek to produce it.


text:
This is the post where I concede defeat. You would think with no facebook to distract me (reinstated, by the way - someone complained about a group that I admin(ed) ), I'd have all that extra time to go out and shoot... but, of days 21-31, only 22, 23 and 29 have photos. I blame the departure of the awesome fog.
22: a park bench.
See the last few photos of the month after the jump:
Day 23: Yahtzee!
Day 29: Sunrise from the Lions Gate Bridge (I'll blame this big gap of photographic fail on going to whistler and not bringing my camera... there was no way I was taking my first laps of Peak chair this season with a 30 pound Sequence bag strapped to my back.)
And finally, day 32 (to make up for no 31 ender). Building the ramp, testing the lights... almost ready for action:
So, there you have it - maybe not complete, but my photo-a-day is done. Check back soon for future updates.


text:
Early slasher cinema will be forever indebted to Bob Clark's Black Christmas, a low-budget Canadian film starring Olivia Hussey and Margot Kidder. And yet - Hollywood went ahead and screwed it up in a reckless attempt to remake and modernize the story, clumsily relying on the foundation of Psycho.
(Beware of Spoilers)
Sadly, Glenn Morgan's 2006 remake of Bob Clark's 1974 film Black Christmas is not a terribly coherent film. In a messy effort to do too much, the film does too little - it loses the essence of the first one which was all about the actual terror of suspense. Here, Billy's extensive backstory crosscuts throughout the plot, exposing a set of reasons why he is incapable of functioning 'normally' in society. Moreover, the theme of sexual harassment, overly present in the original is played down by having the calls no longer be perverted, and yet Billy as a voyeur becomes a major theme. Meanwhile, the film seems to try to use the themes of voyeurism and the breakdown of the family to create an intertextual relationship to Psycho.
Subequently, the film is no longer explicitly about the vulnerability of women as there is no sexual harassment (save for the one scene in which Billy secretly watches Lauren shower as an obvious and out of place homage to Psycho). Instead, it becomes more traditional in its exploitation of the bad mother/good mother myth through its use of the virgin/whore dichotomy, albeit updated to embroider the good mother/virgin (Kelli) with feminist characteristics such as rationality, and authority and vigor when necessary. By the end however such characteristics are subdued when she is taken home by her mother in a traumatized state. Somehow, she becomes just another victim.
The recurrent victimization of women in slashers has been discussed by many, including William Schoell who asserts that this tactic is connected to the fact that the idea of women needing protection is simply "ingrained in the public consciousness", and is therefore unlikely to ever go away. Ultimately though, Billy's violence becomes a consequence of his life and psychosis rather than being explicitly about women as it was in Clark's version. Instead, violence is all he knows. This is another example of the way the film may be thought of as borrowing from Psycho.
Speaking about Hitchcock's film as a pre-cursor to the slasher, Clover notes the significant conventions as follows: "the killer is the psychotic product of a sick family, but still recognizably human; the victim is a beautiful, sexually attractive woman; the location is not home, a terrible place...". Unfortunately, Black Christmas certainly lacks both the cinematic and narrative sophistication of Hitchcock's film. Instead, major themes such as voyeurism, consumption, and the virgin/whore dichotomy, seem to be simply thrown together in a blender with little to no use of critical thought.
Despite the story being founded on Clark's original ideas about the character Billy, the film is seriously lacking anything that resembles finesse. It's all about the spectacle of the wet death (a phrase by which Isabelle Christina Pinedo describes all post-modern horror), denying the viewer any reason to care about anyone or anything that's going on.
In a word, it's a MESS.
Click Here for my look at the original and why it is such an important film in slasher history
Click Here for my look at the original and why it is such an important film in slasher history


text:
You can find a variety of free wood burning, also known as pyrography, patterns at WoodworkersWorkshop.com and LSIrish.com. You can easily print out your pattern and get started on your project right away.
WoodworkersWorkshop.com offers free patterns including a Halloween ballerina, several pictures of dogs and religious scenes. If you have a specific concept in mind, you can use the search bar to locate your desired pattern. LSIrish.com has several free patterns to choose from, including a carousel horse and "The American Hero", a tribute to the September 11 firefighters. Many of the free patterns on LSIrish.com provide detailed step-by-step directions on how to complete your wood burning project. For example, the 9-11 Fireman Pyrography project includes a list of all of the required supplies. It also describes how to complete each step of the project, and a number of wood burning tips. You can view photos of the project in progress to verify your own work. The LSIrish.com website provides tutorials written by Lora S. Irish, who is considered an expert in wood burning and carving. In addition to finding a plethora of free patterns, you can also learn how to prepare your wood surface, how to finish your overall design and how to use other materials, such as leather, for your pyrography projects.