3Com OfficeConnect 3CP4144, Cli User'S Manual

Page: 65 / 144

Creating Filters Using Command Line Interface 6-29
Creating Filters Using
Command Line
Interface
Before creating a filter file, you should carefully identify the information you want
to filter. Decide if you want a filter that discards packets (such as reject all IP
packets whose IP source address is 192.168.200.50) or accept only a subset of
packets (such as accept only bridged packets if the destination MAC address is
002069000001 or 002069000002). Also determine where you want to place the
filter. For example, figure out if you want to apply the filter to packets coming into
the Ethernet port, to packets going out the WAN (ATM) port, or to packets
coming from a specific VC/remote site.
The first step in creating a filter on the OfficeConnect Remote 812 is to create a
file using a text editor on a workstation. The file will contain filters defined in the
OfficeConnect Remote 812 filter syntax (described below). File names should be
short and descriptive, such as IP.FLT.
The next step is to use TFTP (Trivial File Transfer Protocol) to copy the filter file from
the workstation to the OfficeConnect Remote 812.
You then use CLI commands to add the filter file to the list of filters and apply the
filter to the appropriate interface or VC / remote site profile.
Filter File Components in
CLI
You define the filtering rules used by the router within filter files. Filter files are text
files that are stored in the unit’s FLASH memory. You can create and modify filter
files using an off-line text editor, then TFTPing the finished file on to the unit.
To be valid, a filter file must always have the following file descriptor on the first
line:
#filter
Be sure that no blank space precedes the descriptor, or an error will occur.
The remainder of the filter file is partitioned into protocol sections. Each protocol
section has a descriptive header and contains the filter rules for that protocol.
Protocol Sections A single filter file can contain all valid protocol sections in any order, but the
sections cannot be repeated. The following conditions will generate errors or
prevent normal filter operation:
■
If you do not specify a protocol section in the filter file, no filtering will occur
and packets of that protocol type will be accepted.
■
If you specify a protocol section but do not define any rules, an error will occur.
The following table describes the valid protocol sections that you can define in
the filter file.
To comment out a protocol section, you must place a pound (#) sign before the
section header and before all rules defined in the section.
Table 6-2 Protocol Sections
Protocol Sections Descriptions
IP IP protocol data filter section
IP-RIP IP RIP advertising filter section
IPX IPX protocol data filter section
IPX-RIP IPX RIP advertising filter section