HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 137 / 576

Fabric OS 6.2 administrator guide 135
IP Filter policy
The IP Filter policy is a set of rules applied to the IP management interfaces as a packet filtering firewall.
The firewall permits or denies the traffic to go through the IP management interfaces according to the
policy rules.
Fabric OS supports multiple IP Filter policies, which are defined at the same time. Each IP Filter policy is
identified by a name and has an associated type. Two IP Filter policy types, IPv4 and IPv6, exist to provide
separate packet filtering for IPv4 and IPv6. An IPv4 address cannot be specified in the IPv6 filter, or vice
versa. There can be up to six different IP Filter policies defined for both types. Only one IP Filter policy for
each IP type can be activated on the affected management IP interfaces.
Audit messages will be generated for any changes to the IP Filter policies.
The rules in the IP Filter policy are examined one at a time until the end of the list of rules. For performance
reasons, the most import rules must be specified at the top.
On a chassis system, changes to persistent IP Filter policies are automatically synchronized to the standby
CP when the changes are saved persistently on the active CP. The standby CP will enforce the filter policies
to its management interface after policies are synchronized with the active CP.
Virtual Fabric considerations: Each Logical Switch cannot have its own different IP Filter policies. IP Filter
policies are treated as a chassis-wide configuration and are common for all the Logical Switches in the
chassis.
Creating an IP Filter policy
You can create an IP Filter policy specifying any name and using type IPv4 or IPv6. The policy created is
stored in a temporary buffer, and is lost if the current command session logs out. The policy name is a
unique string composed of a maximum of 20 alpha, numeric, and underscore characters. The names
default_ipv4
and
default_ipv6
are reserved for default IP filter policies. The policy name is
case-insensitive and always stored as lowercase. The policy type identifies the policy as an IPv4 or IPv6
filter. A maximum of six IP Filter policies can be created for both types.
1. Log in to the switch using an account assigned to the admin role.
2. Enter the following command:
ipfilter --create < policyname > -type < ipv4 | ipv6 >
where
< policyname >
is the name of the new policy and
-type
is specified as an IPv4 or IPv6 address.
Cloning an IP Filter policy
You can create an IP Filter policy as an exact copy of an existing policy. The policy created is stored in a
temporary buffer and has the same type and rules as the existing defined or active policy.
1. Log in to the switch using an account assigned to the admin role.
2. Enter the following command:
ipfilter --clone <policyname> -from <src_policyname>
where
<policyname>
is the name of the new policy and
<src_policyname>
is the name of the policy
you want to copy.
Displaying an IP Filter policy
You can display the IP Filter policy content for the specified policy name, or all IP Filter policies if a policy
name is not specified.
For each IP Filter policy, the policy name, type, persistent state and policy rules are displayed. The policy
rules are listed by the rule number in ascending order. There is no pagination stop for multiple screens of
information. Pipe the output to the
|more
command to achieve this.
If a temporary buffer exists for an IP Filter policy, the
--
show
subcommand displays the content in the
temporary buffer, with the persistent state set to no.
1. Log in to the switch using an account assigned to the admin role.