Per MSSEI guideline, Protection Level P2 and P3 data is not required to meet MSSEI encryption in transit requirement when traversing the UC Berkeley campus wired network. UC Berkeley campus wired network generally falls these IP address spaces: 128.32.0.0/16, 169.229.0.0/16, 136.152.0.0/16, 2607:f140::/32, and the campus routed rfc1918 IP address space.
This exception does not include transmission over the CENIC network to the San Diego Super Computer (e.g., UC Backup) data center, off-campus networks that are still part of the campus IP address space, or wireless networks such as Airbears. Applications or systems (e.g. file servers) wishing to take advantage of the campus wired network encryption exception must restrict access to and from all other networks. This can be accomplished by applying firewall rules.
For example, if a file server is hosting UC P2/P3 data on the campus wired network, the following sample firewall rules can be implemented on the file server to meet the criteria for this exception:
- allow access to/from address spaces noted below as part of the campus wired network
- 128.32.0.0/16 - UCB net
- 169.229.0.0/16 - UCB net
- 136.152.208.0/23 - campus vpn clients
- 136.152.210.0/23 - campus vpn clients
- Campus rfc1918 IP address space:
- 10.16.0.0/12
- 10.32.0.0/11
- 10.64.0.0/10
- 10.128.0.0/9
- 172.16.0.0/12
- deny access to/from 10.40.0.0/13, 10.56.0.0/13, 136.152.64.0/19, 136.152.209.0/24, 136.152.214.0/23, 2607:f140:400::/48 and 2607:f140:6000::/48, which is part of the campus rfc1918 IP address space, but are allocated to eduroam, the IoT network, and guest wifi clients. This rule must have a higher priority than the previous firewall rules.
- deny access to/from all other networks (default deny rule)
Additional tweaks to the firewall rules may be needed to accommodate edge cases where network connections do not meet the rules outlined above.
