PNF CONFIGURATION REQUIRED FOR CYBER SECURITY INSTALLATION

System firewall will be turned “On” at all times.

FE can turn “Off” System firewall until next boot with Class M key.

Remote user can turn “Off” System firewall.

To check the firewall status, perform the following:

Open Service Tools > Common Service Desktop (CSD)
Click on “Configuration” Tab and select “Configure Enhanced PNF”
Confirm status of Firewall.

Any existing filters on the system will be displayed. Review and remove any filters that are not needed.

By default, all inbound connections are blocked by the Revolution CT System’s internal firewall, with the exemptions listed in the table below.

The column "Recommended configuration of network infrastructure" describes the suggested configuration of the network infrastructure regarding the different network services.

note: * Configure PNF can be opened irrespective of which user logged in, if valid Class M key is inserted

Table 1. Inbound firewall configuration for the Revolution CT System
Local port	Allowed Remote IP	Protocol	Recommended configuration of network infrastructure	Network service
4006	Any	TCP	Open to all HDO approved / authorized DICOM server(s) configured on the system. This is by default configured in the DICOM tab.	DICOM
8081*	Any	TCP	In PNF, Expert tab add new filter as below Name: ePO <Any name> Allowed IP: <Enter IPv4 address of ePO Server Allowed Port: <8081 or Agent Communication port> Protocol: TCP	McAfee ePO agent
2762	Any	TCP	Open to all HDO approved / authorized DICOM server(s) capable of TLS communication configured on the system.	DICOM over TLS
514*	Any	TCP	No PNF configuration needed on CT Console client side. Syslog-ng uses TCP port 514 (Default), User can configure different TCP port on the Server	Syslog-NG log transfer to remote Log Server

note: Note that ports configured can be different from defaults listed above. Firewall configuration should be updated accordingly

Procedure