Skip to content

HSCN Firewall Rules

Source: HSCN Firewall Changes (TRIB 19398819849)

Overview

HSCN firewall rules are managed by Redcentric through the SMAX portal. Any change to the HSCN firewall (adding new rules, modifying existing ones, opening ports for a new customer) must go through a formal change request on the Redcentric portal.

Authorisation required

All HSCN firewall change requests require prior authorisation from Franck Dakpogan or Brendon McAlevey before being submitted.

Redcentric Portal

Portal Users (Rhapsody/Lyniate team)

Name Role
John Mitchell Redcentric contact
Franck Dakpogan Primary authoriser
Noby Smith Manager
Andy Xian SRE
Lee Jelley Senior Engineer
Luke Sweeney Engineer
Bilal Siddique SRE
Zaine Mani SRE

Raising a Firewall Change Request

  1. Get authorisation from Franck Dakpogan or Brendon McAlevey (email or Teams message is sufficient).
  2. Log into the Redcentric SMAX portal.
  3. Create a new change request and fill in the firewall change form:
Field Description
Action Add, Remove, or Append
Rule Name A descriptive name (e.g., RaaS-WestHerts-Prod-inbound)
Source IP Source IP address or subnet
Source Prefix Source prefix/mask
Dest IP Destination IP address or subnet
Dest Prefix Destination prefix/mask
Protocol TCP, UDP, ICMP, etc.
Dest Port Destination port(s)
Action Allow or Deny
  1. Add the authorisation reference (who approved it and when) in the request notes.
  2. Submit and await Redcentric confirmation.

HSCN Testing

To test HSCN connectivity before a live cutover, use the Redcentric HSCN VPN client (Cisco AnyConnect).

The Cisco AnyConnect client connects you to the HSCN network, from where you can test connectivity to customer systems before the tunnel goes live.

HSCN Testing IPs (Cisco AnyConnect loadbalanced):

IP Use
195.104.34.164/32 Primary testing IP
195.104.35.164/32 Secondary testing IP

See Redcentric VPN Client for installation instructions.

ANM (Advanced Network Management)

ANM is a Redcentric service that allows HSCN customers to break out to the public internet via a controlled egress path.

  • Appliance IP range: 208.127.192.0/21
  • Used when HSCN-connected systems need to call external APIs or services
  • Must be explicitly requested and configured by Redcentric

Actual Firewall Policy Examples

Source: HSCN Customer Firewall Rules (TRIB 19626721749)

The following are example FortiGate firewall policies from the Redcentric HSCN infrastructure, showing real policy configurations for West Hertfordshire NHS Trust VPN.

Interface: UK-HG1-MFWS-FNET2 (Harrogate site)

Policy # Name Source Destination Services Action
1 GENERAL-OUTBOUND all all ALL ACCEPT
2 ISAKMP ESP AH INBOUND all all AH, ESP, IKE, PING, TCP_3041, TCP_8444 ACCEPT
3 West Hertfordshire VPN 10.104.29.20/32, 10.104.29.4/32 10.151.192.1/32, 10.151.223.68/32 AH, ESP, IKE ACCEPT
4 West Hertfordshire VPN (reverse) 10.151.192.1/32, 10.151.223.68/32 10.104.29.20/32, 10.104.29.4/32 AH, ESP, IKE ACCEPT
5 Lincs Test 10000 Lincs test addr Lincs test addr TCP_10000 ACCEPT
6 Lincs Test 10000 (reverse) Lincs test addr Lincs test addr TCP_10000 ACCEPT

Interface: UK-RED2-MFWS-FNET1 (Reading site)

Same policy set mirrored for the Reading location — policies 1–6 with identical logic targeting the same West Hertfordshire IP ranges.

Key IP Ranges

IP Range Description
10.104.29.0/24 HSCN IPAM allocation (Rhapsody-managed)
10.104.29.20/32, 10.104.29.4/32 RaaS VPN endpoint IPs (Harrogate/Reading)
10.151.192.1/32, 10.151.223.68/32 West Hertfordshire NHS Trust systems

Services Referenced

Service Protocol/Port
AH IP Protocol 51 (IPSec Authentication Header)
ESP IP Protocol 50 (IPSec Encapsulated Security Payload)
IKE UDP 500, UDP 4500 (key exchange)
TCP_3041 TCP 3041 (custom Rhapsody comms)
TCP_8444 TCP 8444 (Rhapsody WMC HTTPS)