Beta Draft Confidential
20-2
1/19/05
ATM Services Configuration Guide for CBX 3500, CBX 500, GX 550, and B-STDX 9000
Port Security Screening
Configuration Overview
About Port Security Screening
The Port Security Screening feature ensures that your network cannot be
compromised by unauthorized SVC access. You do this by creating screens that can
allow/disallow incoming and outgoing SVCs. You configure each screen with the
following information:
•
SVC direction — Screen either ingress (incoming) or egress (outgoing) SVCs.
•
Screen type — Pass or block SVCs according to the configured screen.
•
Address type — Any address type used in a public or private UNI. This includes
E.164 and X.121 formats for calling and called party addresses, and the network
service access point (NSAP) ATM End System Address (AESA) format for
calling and called subaddresses.
•
Matching information — Address criteria that either allows or disallows the SVC.
Once you develop a set of screens, you can apply them to any UNI or NNI logical port
in your network. You can use a maximum of 16 different screens per port. Using these
screens, the port checks every SVC it receives and/or sends for the matching criteria
specified in the screen(s). If the SVC meets the matching criteria specified in at least
one of these screens, the port either passes or blocks that SVC according to the
security screen design.
Implementing Port Security Screening
Although you can apply multiple security screens to a single logical port, the decision
as to whether an SVC is passed or blocked is made based on the combined effects of
the following:
•
The default ingress/egress screen mode for the logical port.
•
The security screens you assign to this logical port.
•
The incoming/outgoing SVC address criteria defined in the security screen.
Default Screens
For each logical port, you configure default screen criteria that specifies the behavior
of any SVC on this port. You can use security screens on both ingress user ports,
which represent SVC originating endpoints, or egress user ports, which in turn
represent SVC terminating endpoints. The default screens enable you to quickly
override the security screens you assign to the logical port; use the default screens to
either pass or block all incoming or outgoing SVCs.
Summary of Contents for CBX 3500
Page 888: ......