3Com 3C421600A, Management Manual

Page: 224 / 300

222 C
HAPTER
14: H
ANDLING
P
ACKET
F
ILTERS
When a packet is filtered, an IP packet for example, the RAS 1500 parses
each rule defined in the IP protocol section sequentially according to the
line number. Filtering is performed based on the first occurring match.
Without a match, the packet is accepted by default. For this reason, you
should order your protocol rules so that rules you expect to be most
frequently matched are situated early in the section to reduce parsing
time during filtering.
Table 58 describes each field used in the rule syntax.
Table 58 Protocol Rules
The OR operation can be implemented by successive ACCEPT rules. For
example, to accept a packet if the source address is xxx, or the
destination address is yyy, the following rules are used:
IP:
010 ACCEPT src-addr = xxx;
020 ACCEPT dst-addr = yyy;
Field Description
line #
Each rule must have a unique line number (
1-999
). You must arrange
rules in increasing order.
verb
This field can be one of the following:
■
ACCEPT
— allow packet access if condition is met
■
REJECT
— do not allow packet access if condition is met
■
AND
— logically use the AND condition with condition of the next
rule to determine if packet is accepted or rejected: both defined
conditions must be met.
IMPORTANT:
No more than 15 consecutive
AND rules are permitted.
keyword
For descriptions, see page 242
operator
Describes the relationship between the keyword and its value. The
operator field must be one of the following (applies to the specific
keyword used):
= !!! Equal
!= !! Not equal
> !!! Greater than
< !!! Less than
>= &! Greater or Equal
<= & Less or Equal
=> !! Generic
value
Contains an entity appropriate for the keyword.