HP E3800 Series, Access Security Manual

Page: 114 / 732

3-28
Virus Throttling (Connection-Rate Filtering)
Configuring and Applying Connection-Rate ACLs
•
filter < source-criteria >
: This ACE type does the opposite of an
ignore
entry. That is, all inbound traffic meeting the configured
< source-
criteria >
must be filtered through the connection-rate policy config-
ured for the port on which the traffic entered the switch. This option
is most useful in applications where it is easier to use
filter
to specify
suspicious traffic sources for screening than to use
ignore
to specify
exceptions for trusted traffic sources that don’t need screening. For
example, if the host at 15.45.127.43 requires connection-rate screen-
ing, but all other hosts in the VLAN do not, you would configure and
apply a connection-rate ACL with
filter ip host 15.45.127.43
as the first
ACE and
ignore ip any
as the second ACE. In this case, the traffic from
host 15.45.127.43 would be screened, but traffic from all other hosts
on the VLAN would be permitted without connection-rate screening.
■ Implicit ACE:
A connection-rate ACL includes a third, implicit filter
ip any ACE which is automatically the last ACE in the ACL. This
implicit ACE does not appear in displays of the ACL configuration,
but is always present in any connection-rate ACL you configure. For
example, assume that a port is configured with a connection-rate
policy and is in a VLAN configured with a connection-rate ACL. If
there is no match between an incoming packet and the ACE criteria
in the ACL, then the implicit
filter ip any
sends the packet for screening
by the connection-rate policy configured on that port. To preempt the
implicit
filter ip any
in a given connection-rate ACL, you can configure
ignore IP any
as the last explicit ACE in the connection-rate ACL. The
switch will then ignore (permit) traffic that is not explicitly addressed
by other ACEs configured sequentially earlier in the ACL without
filtering the traffic through the existing connection-rate policy.
■ Monitoring Shared Resources: Active instances of throttling or
blocking a client that is generating a high rate of connection requests
uses internal routing switch resources that are shared with several
other features. The routing switch provides ample resources for all
features. However, if the internal resources become fully subscribed,
new instances of throttling or blocking cannot be initiated until the
necessary resources are released from other uses. (Event Log
messages and SNMP traps are not affected.) For information on
determining current resource availability and usage, refer to the
appendix titled “Monitoring Resources” in the
Management and
Configuration Guide for your switch.