3Com 3036, Configuration Manual

Page: 553 / 762

Firewall Overview 549
Figure 171 Packet filtering schematic diagram
The following can be realized by data packet filtering:
■
Prohibit logging on with telnet from outside
■
Every E-mail is sent by SMTP (Simple Message Transfer Protocol).
■
One PC, rather than all other PCs, can send news to us by NNTP (Network
News Transfer Protocol).
Packet filtering in 3Com routers security equipment features the following:
■
Based on access-list (Access Control List - ACL): ACL is applied not only in
packet filtering but also in other features where data streams need to be
classified, such as address translation and IPSec.
■
Support standard and extended ACL: Set a simple address range with the
standard ACL or set the specific protocol, source address range, destination
address range, source port range, destination port range, priority and service
type with the extended ACL.
■
Support time segment: Set ACL functions in a specific period of time, such as
8:00-2:00 of every Monday, or it can be as specific as from a year/month/day to
another year/month/day.
■
Support ACL automatic sorting: You can select sorting ACLs of a specific
category to simplify the configuration and facilitate the maintenance.
■
It can be as specific as indicating the input/output direction: For example, a
special packet filtering rule can be applied in the output direction of the
interface that is connected with WAN or another packet filtering rule is applied
in the input direction.
■
Support interface based filtering: It can be set to prohibit or permit to forward
messages from a specific interface in a specific direction of an interface.
■
Support creating a log for message meeting the condition: Record the related
information of the message and provide a mechanism to guarantee that
excessive resources are not consumed when a large number of logs are
triggered in the same way.
Access Control List To filter data packets, rules need to be configured. A rule identifies a packet to be
considered by an Access Control List.
The access control list is generally employed to configure the rules to filter data
packets, and the types of access control lists are as follows:
■
Standard access control list