ESR service routers. ESR-Series. Functionality description. Version 1.12.0
274
esr(config)# security zone LAN
esr(config-zone)# exit
esr(config)# security zone WAN
esr(config-zone)# exit
esr(config)# security zone-pair LAN WAN
esr(config-zone-pair)# rule
100
esr(config-zone-pair-rule)# action permit
esr(config-zone-pair-rule)# enable
esr(config-zone-pair-rule)# ex
esr(config-zone-pair)# exit
esr(config)# security zone-pair WAN LAN
esr(config-zone-pair)# rule
100
esr(config-zone-pair-rule)# action permit
esr(config-zone-pair-rule)# enable
esr(config-zone-pair-rule)# exit
esr(config-zone-pair)# exit
esr(config)#
interface
gigabitethernet
1
/
0
/
1
esr(config-
if
-gi)# security-zone LAN
esr(config-
if
-gi)# ip address
192.168
.
0.1
/
24
esr(config-
if
-gi)# exit
esr(config)#
interface
gigabitethernet
1
/
0
/
2
esr(config-
if
-gi)# security-zone WAN
esr(config-
if
-gi)# ip address
10.0
.
0.1
/
24
esr(config-
if
-gi)# exit
Enable the protection against land, syn-flood, ICMP flood attacks:
esr(config)# ip firewall screen dos-defense land
esr(config)# ip firewall screen dos-defense syn-flood
100
src-dst
esr(config)# ip firewall screen dos-defense icmp-threshold
100
Configure the logging of detected attacks:
esr(config)# ip firewall logging screen dos-defense land
esr(config)# ip firewall logging screen dos-defense syn-flood
esr(config)# ip firewall logging screen dos-defense icmp-threshold
Configure SNMP server to which the traps will be sent:
esr(config)# snmp-server
esr(config)# snmp-server host
192.168
.
0.10
To view the statistics on recorded network attacks, use the following command:
esr# show ip firewall screen counters
7.5 Firewall configuration
Firewall is a package of hardware or software tools that allows for control and filtering of transmitted network
packets in accordance with the defined rules.
