CoreWatch User’s Manual
225
Chapter 13: Configuring Security on the SSR
administrator to know ahead of time that a packet should be dropped at the inbound
interface. Nonetheless, for performance reasons, whenever possible, one should create
and apply an ACL to the inbound interface.
When a packet comes into a router at an interface where an inbound ACL is applied, the
router compares the packet with the rules specified by that ACL. If it is permitted, the
packet is allowed into the router. If not, the packet is dropped. If that packet is to be
forwarded to go out of another interface (that is, the packet is to be routed) then a second
ACL check is possible. At the output interface, if an outbound ACL is applied, the packet
will be compared with the rules specified in this outbound ACL. Consequently, it is
possible for a packet to go through two separate checks, once at the inbound interface and
once more at the outbound interface.
Note:
When you apply an ACL to an interface, the SSR appends an
implicit deny rule
to
that ACL. The implicit deny rule denies all traffic. If you intend to allow all traffic
that does not match your specified ACL rules to go through, you must explicitly
define a rule to permit all traffic. To do so, make sure the last rule of the ACL
permits all traffic.
You can apply previously defined IP ACLs only to IP interfaces and previously defined
IPX, IPX RIP, or IPX SAP ACLs only to IPX interfaces.
Caution
: You can apply up to two IP ACLs to an IP interface, and you can apply two of
each of the different IPX ACLs (IPX, IPX RIP, and IPX SAP) to an IPX interface. When
applying multiple ACLs to an IP interface, one ACL must govern inbound traffic and the
other ACL must govern outbound traffic. When applying multiple ACLs of the same type
to an IPX interface, one ACL must govern inbound traffic and the other must govern
outbound traffic.
You may apply an ACL to an interface either when you create the interface or afterwards.
For details on applying an IP ACL while creating an IP interface, see
“Creating IP
Interfaces” on page 110
. For details on applying an IPX, IPX RIP, or IPX SAP ACL while
creating an IPX interface, see
“Creating IPX Interfaces” on page 161
.
You apply an IP or IPX, IPX RIP, or IPX SAP ACL to an interface after the interface is
created by either copying the ACL or by editing the interface’s definition. Separate
discussions on each task follow.
Copying an ACL to Apply It to an Interface
You can copy an ACL to apply it to an interface by either dragging it or using the Copy
and Paste buttons. To apply an ACL by copying it to an interface:
1.
Start Configuration Expert if you have not already done so.
2.
Open the configuration file you want to modify and then double-click that file’s
Routing Configuration object.
3.
Expand the configuration tree until you locate the interface to which you want to
apply the ACL. Double-click that interface’s object.
Summary of Contents for SSR-GLX19-02
Page 1: ...CoreWatch User s Manual 9032564 04...
Page 2: ...Notice 2 CoreWatch User s Manual...
Page 20: ...Preface 20 CoreWatch User s Manual...
Page 64: ...Chapter 5 Changing System Settings 64 CoreWatch User s Manual...
Page 86: ...Chapter 6 Configuring SSR Bridging 86 CoreWatch User s Manual...
Page 106: ...Chapter 7 Configuring VLANs on the SSR 106 CoreWatch User s Manual...
Page 206: ...Chapter 12 Configuring QoS on the SSR 206 CoreWatch User s Manual...
Page 246: ...Chapter 13 Configuring Security on the SSR 246 CoreWatch User s Manual...
Page 363: ...CoreWatch User s Manual 363 Chapter 16 Configuring Routing Policies on the SSR 9 Click OK...
Page 364: ...Chapter 16 Configuring Routing Policies on the SSR 364 CoreWatch User s Manual...
Page 370: ...Chapter 17 Checking System Status 370 CoreWatch User s Manual...
Page 390: ...Chapter 18 Monitoring Real Time Performance 390 CoreWatch User s Manual...
Page 396: ...Chapter 19 Checking the Status of Bridge Tables 396 CoreWatch User s Manual...
Page 430: ...Chapter 20 Checking the Status of Routing Tables 430 CoreWatch User s Manual...
Page 442: ...Chapter 22 Obtaining Reports 442 CoreWatch User s Manual...
Page 456: ...Appendix B CoreWatch Menus 456 CoreWatch User s Manual...