Chapter 7: Practical Firewall Design

Palo Alto Networks (a leading next-generation FW vendor)

Fortinet (FortiGate)

Example of a firewall appliance (Cisco ASA 5510)
Appearance of an enterprise firewall used in hospital networks

7.1 FQDN-Based vs. IP-Based Allow Rules

Two Allow Methods

There are broadly two methods for allowing outbound traffic through a firewall.

Why FQDN-Based Allow Rules Are Recommended for AWS

With AWS services, IP addresses can change dynamically for the following reasons:

• Load balancer scaling: IPs are added or changed in response to load
• Failover during outages: Traffic may switch to a different IP address
• Maintenance: IP changes due to AWS infrastructure updates

When FQDN-Based Allow Rules Cannot Be Used

Older firewall appliances may not support FQDN-based allow rules. The following workarounds are available in such cases.

7.2 Port Opening Principles

Principle of Least Privilege

Firewall port openings should be designed based on the principle of allowing only the minimum necessary traffic.

Ports Required for Smart Assist

Firewall Rule Design Example

# Smart Assist Traffic Allow Rules

Rule 1: HTTPS Traffic
  Source:      192.168.10.50/32  (Smart Assist PC)
  Destination: smartassist.example.com
  Protocol:    TCP
  Dest Port:   443
  Action:      ALLOW

Rule 2: DNS Traffic (for direct DNS)
  Source:      192.168.10.50/32  (Smart Assist PC)
  Destination: Hospital Internal DNS Server
  Protocol:    UDP
  Dest Port:   53
  Action:      ALLOW

Default Rule:
  Source:      *
  Destination: *
  Protocol:    *
  Dest Port:   *
  Action:      DENY

Configurations You Must Never Use

7.3 Considerations for Proxy Environments

Traffic Flow Through a Proxy

In a proxy environment, the Smart Assist PC communicates through the proxy server rather than directly through the firewall.

Required Settings for Proxy Environments

Proxy Configuration on the Smart Assist PC

# Setting via environment variables
HTTPS_PROXY=http://proxy.hospital.local:8080

# Setting via application configuration
Proxy Host: proxy.hospital.local
Proxy Port: 8080

Handling Authenticated Proxies

With an authenticated proxy, authentication credentials must be sent with each communication.

7.4 Impact of SSL Inspection

What Is SSL Inspection?

SSL inspection (also called SSL/TLS inspection or HTTPS inspection) is a feature where the firewall or proxy decrypts and inspects the contents of encrypted HTTPS traffic.

How It Works

Impact on Smart Assist

Remediation Methods

In most cases, the exclusion setting is the simplest and most reliable approach.

7.5 How to Write a Firewall Allow Request

Information to Include in Hospital Requests

Firewall allow requests must contain all the information the hospital IT department needs to make a decision, without excess or omission.

Request Template

7.6 How to Explain to Hospital IT

Fundamental Principles of Explanation

Recommended Explanation Flow

Explanation Patterns to Avoid

Note (International Context): The firewall allow request template presented in this chapter follows a standard format for Japanese hospital IT departments. In the United States, the request process is typically based on vendor security questionnaires (SIG: Standardized Information Gathering, CAIQ: Consensus Assessment Initiative Questionnaire) or HIPAA Security Risk Assessments. In the EU, a DPIA (Data Protection Impact Assessment) under GDPR Article 35 and consultation with a DPO (Data Protection Officer) are often required. Regardless of region, the fundamentals remain the same: visualize the communication flow, clearly state what data is transmitted, and provide technical evidence that traffic is Outbound Only.

7.7 Reading the Documentation: FW Allow FQDN List (Actual Configuration Values)

Overview of the Documentation

The Network Explanatory Materials contain a list of specific FQDNs and ports that need to be allowed on the firewall. Field engineers use this list to present specific FW configuration proposals to hospital IT administrators.

Smart Assist Communications (Required)

Time Synchronization (NTP)

Security Software Updates

Windows Update

Note: Refer to the Network Explanatory Materials for the complete list of Windows Update FQDNs. The above is an excerpt of the major ones.

When Using the VPN Connection Option (Option 2)

When the VPN connection option is selected, only the FQDN allow rules for Smart Assist communications are needed (NTP, McAfee, and Windows Update will route through the VPN).

Key Points for Field Engineers

1. Wildcard (*) allow rules: Wildcard specifications such as *.arkray-smartassist.com may not be supported by some FW appliances. In that case, allow specific subdomains individually
2. S3 FQDN: The direct access URL for S3 buckets is a long FQDN that includes region information. Make sure to copy it exactly
3. Importance of NTP: If time synchronization fails, TLS certificate validation may also fail (see Chapter 10 for certificate expiration troubleshooting)
4. Phased allow approach: It is also effective to first allow only the two Smart Assist communication entries, test connectivity, then add NTP and update-related entries

In the next chapter, we will understand the basic structure of AWS, the cloud infrastructure behind Smart Assist.