3Com OfficeConnect 3C100XF, Cli User'S Manual

Page: 218 / 260

27-8 C
HAPTER
27: P
ACKET
F
ILTERS
or rejects the packet. Interface filters can be applied dynamically without having to
disable and re-enable each network on that interface.
Input Filter
If an input filter is configured on an interface, all received packets are checked
against the filtering rules before being forwarded to another interface.
Output Filters
If an output filter is configured on an interface, all outbound packets are checked
against the filtering rules before exiting the interface.
Input Filters vs. Output Filters
When possible, use the input filter to filter an incoming packet rather than waiting
to catch a packet as it attempts to exit. This is recommended because:
A packet is prevented from entering, keeping potential intruders from
attacking the OfficeConnect Gateway.
The routing engine does not waste time processing a packet that is going to be
discarded anyway.
Most importantly, the OfficeConnect Gateway does not know which interface
an outgoing packet came in through. If a potential intruder forges a packet
with a false source address (in order to appear as a trusted host or network)
there is no way for an output filter to tell if that packet came in through the
wrong interface. An input filter, on the other hand, can filter out packets
purporting to be from networks that are actually connected to a different
interface.
User Filters You can configure user filters for a specific user that control access to the network
for that user. This filter is only applied for the duration of the user’s network
connection. As with interface filters, a user filter can be configured as an input or
output.
Assigning Filters You can assign filters to interfaces and / or users using CLI commands. The
following section describes:
Assigning a filter to an interface
Assigning a filter to a user profile
Setting filter access
Assigning a Filter on an Interface
set interface
<interface_name>input_
filter <filter_name>
output_filter
<filter_name>
Filter_access on
Use this command string to configure an input or output filter on an interface.
For example:
set interface slot:4/port:8 input_filter filter.flt filter_access on
Filter files take effect on an interface immediately on enabled networks when you
issue the
set interface command.