Section C: Controls for restricting client-to-NetCache traffic

How NetCache typically accepts requests

Typically, NetCache accepts client requests through any interface and IP address, including any interface and IP address for an Internet link. You can add a level of security by restricting the IP addresses and, therefore, the interfaces through which NetCache accepts client requests.

Note
Interfaces can have more than one IP address.

Option you can use to change NetCache behavior

Using the Listen Addresses option, you can limit the NetCache appliance IP addresses on which NetCache listens for client requests. If a TCP or UDP IP address is specified in this option, NetCache listens only on that IP address. If the Listen Addresses box is left blank, NetCache listens on all of its TCP or UDP interfaces.

The Listen Addresses option is on the Network - General page (Setup tab > Network > General).

Determining whether you should use this option

Consider the following when determining whether to use this option:

Only the IP addresses associated with the interfaces of this NetCache appliance can be listed in this option.
You must enter a full IP address, not a network address or a subnet address.
Each interface for an IP address listed in this option must be configured as up; otherwise, NetCache will not listen on it.
You cannot use this option if transparency is enabled for any protocol. The reason is that the destination IP address will never be the NetCache appliance, only a destination server.
You cannot use this option if this NetCache appliance is part of a takeover pair.

Difference between using this option and using access controls

The difference between using the Listen Addresses option and using access controls is that if you list the IP addresses of some interfaces in this option, NetCache does not accept connections through interfaces whose IP addresses are not listed. With access controls, NetCache accepts the connection but then filters out requests based on the access control that is set.

Examples of how the Listen Addresses option can be used

You can use the Listen Addresses option in the following ways:

Example 1: Allowing client traffic from your internal network but not allowing traffic from the Internet

If your NetCache appliance is inside your firewall and your firewall does not block access from all clients external to your organization, you can specify in the Listen Addresses option only the IP addresses of the interfaces to your organization's internal networks. Because the IP address for the interface to the Internet is not listed in the Listen Addresses option, NetCache will not listen on that interface. Therefore, clients on the Internet cannot access your NetCache appliance.

Example 2: Preventing random access

If your NetCache appliance is outside your firewall and you want to limit requests to your NetCache appliance to only requests from clients inside the firewall, specify in the Listen Addresses option the IP address of the interface that is connected to the firewall. NetCache will not listen on any other interfaces and, therefore, will not accept requests from hosts on the Internet.