Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 732 / 1193

Filter and Firewall
Left running head:
Chapter name (automatic)
706
Beta Beta
CLI Configuration Guide
Alcatel-Lucent
C) Filters for Traffic Coming from the Internet
ALU(config)# ip filter untrust-traffic
ALU(config-filter-untrust-traffic)#match any Internet-mail-
access permit
ALU(config-filter-untrust-traffic)#match any webserver-
access permit
ALU(config-filter-untrust-traffic)#match any RFC-1918 deny
log
ALU(config-filter-untrust-traffic)#match any manage-untrust
permit
ALU(config-filter-untrust-traffic)#default deny
Applying this filter as ‘in’ on Untrust interface
ALU(config-if Serial0:0)#ip filter in untrust-traffic
ALU(config)# ip filter out-untrust
ALU(config-filter-out-untrust)#10 match any Internet-access
permit
ALU(config-filter-out-untrust)#20 match any untrust-DMZ-
access permit
ALU(config-filter-out-untrust)#default deny
This filter is applied as "out" filter
ALU(config-if Serial0:0)#ip filter out out-untrust
12. Configuring Source NAT for all Traffic Going Towards Internet
ALU(config)# ip nat source-nat
ALU(config-nat-source-nat)# match any source-nat source-nat
Applying the Source NAT on the serial interface as out NAT policy so that all the
internal traffic gets NAT ed to the public IP of the Serial Interface.
ALU(config-if Serial0:0)#ip nat out source-nat
13. Configuring the DNAT Rules for the DMZ
ALU(config)# ip nat DNAT
ALU(config-nat-DNAT)#match any Internet-mail-access
destination-nat host 172.16.0.130
ALU(config-nat-DNAT)#match any webserver-access
destination-nat host 172.16.0.131
Applying this DNAT rule as a IN nat policy for the mail and webserver access.
ALU(config-if Serial0:0)#ip nat in DNAT