ESR service routers. ESR-Series. Functionality description. Version 1.12.0
281
Step
Description
Command
Keys
43
Set the filtration only for fragmented
IP packets (optional, available only
for zone-pair any self and zone-pair
<zone-name> any).
esr(config-zone-pair-
rule)# match [not]
fragment
44
Set the filtration only for IP packets
including ip-option (optional,
available only for zone-pair any self
and zone-pair <zone-name> any).
esr(config-zone-pair-
rule)# match [not] ip-
option
45
Create an interzone interaction rule.
esr(config-zone-rule)#
enable
46
Enable filtering and session tracking
mode while packets are transmitted
between one Bridge group
participants (optional, available only
for ESR-1000/1200/1500/1700)
esr(config-bridge)#
ports firewall enable
1
When using the not key, the rule will work for values which are not included in a specified profile.
Each “match” command may contain “not” key. When using the key, packets that do not meet the given
requirement will fall under the rule.
You can obtain more detail information about firewall configuration in “CLI command reference guide”.
7.5.2 Firewall configuration example
Objective:
Enable message passage via ICMP between R1, R2 and ESR router.
Solution:
Create a security zone for each ESR network:
esr# configure
esr(config)# security zone LAN
esr(config-zone)# exit
esr(config)# security zone WAN
esr(config-zone)# exit
