Enterasys APS-3000 Spezifikationen Seite 348

  • Herunterladen
  • Zu meinen Handbüchern hinzufügen
  • Drucken
  • Seite
    / 500
  • Inhaltsverzeichnis
  • LESEZEICHEN
  • Bewertet. / 5. Basierend auf Kundenbewertungen
Seitenansicht 347
18-18 VNS Commands (vnsmode)
Usage
Ifthespecifiedrulepositionalreadycontainsafilterrule,specifyingaruleusingthiscommand
insertsaruleinthecurrentlyexistingrulespositionandresequencesallotherrulesbelowthisrule
byoneposition.Usethecreatecommandtoinsertorappendaruleatthespecifiedposition.
If
advancedfiltermodehasbeenenabledwiththeenableadvancefilteringcommand(page203),
theAdvancedmodesyntaxispresented.Ifadvancedfiltermodeisnotenabled,theBasicmode
syntaxispresented.
Examples
Thefollowingexamplecreatesafilter rule1thatallowsUDPtrafficinbothdirectionsfrom
subnet10.10.10.0/24forports10through2000:
EWC.enterasys.com:vnsmode:default-policy:apfilters# create 1 proto udp
10.10.10.0/24 port 10 2000 in dst out src allow
EWC.enterasys.com:vnsmode:default-policy:apfilters# show
Custom AP Filters: enable
filter 1 proto udp 10.10.10.0 255.255.255.0 port 10 2000 in dst out src allow
filter 2 (default) proto none 0.0.0.0 all_ports in dst out src deny
EWC.enterasys.com:vnsmode:default-policy:apfilters#
Thefollowingexamplecreatesafilterrule1thatisinsertedintotherulelistatposition1becausea
rulealreadyexistsforrule1.This filterruleallowsICMPtypes9through31trafficinboth
directionsfromIPaddress20.20.0.0/16:
EWC.enterasys.com:vnsmode:default-policy:apfilters# create 1 proto icmp
20.20.0.0/16 type 9 31 in dst out src allow
EWC.enterasys.com:vnsmode:default-policy:apfilters# show
Custom AP Filters: enable
filter 1 proto icmp 20.20.0.0 255.255.0.0 type 9 31 in dst out src allow
filter 2 proto udp 10.10.10.0 255.255.255.0 port 10 2000 in dst out src allow
filter 3 (default) proto none 0.0.0.0 all_ports both deny
EWC.enterasys.com:vnsmode:default-policy:apfilters#
Basic:out(none|src)
Advanced:
out
(none|src|dst|both)
Specifiesthedirectionofpacketflow.outspecifiesapacketflow
fromtheACtotheAP(outofnetwork).
nonespecifiesthattheoutdirectiondoesnotapplytothefilterrule.
dstspecifiesthatthe IPaddressforthisfilterruleisthedestination
of
thepacketflow.
srcspecifiesthattheIPaddressforthisfilterruleisthesourceofthe
packetflow.
bothspecifiesthattheIP addressforthisfilterrulecanbeeithersource
ordestination.
allow|deny Specifieswhetherpacketswillbeallowedordeniedwhenmeetingthe
criteriaspecifiedinthefilterrule.
Seitenansicht 347
1 2 ... 343 344 345 346 347 348 349 350 351 352 353 ... 499 500

Kommentare zu diesen Handbüchern

Keine Kommentare