3Com 3C421600A, Руководство по управлению

Страница: 226 / 300

224 C
HAPTER
14: H
ANDLING
P
ACKET
F
ILTERS
Specifying the Filtering Action
You can specify the filtering action for each protocol section that
determines whether a packet is accepted or rejected if no match occurs
with any of the rules defined in the section. To do so, enter one of the
following values as the
last rule line of the section:
■
ACCEPT
■
DENY
For example, the following entry would reject IP packets that did not
match any of the rules defined in the IP protocol section:
#filter
IP:
010 ACCEPT tcp-dst-port> = 24;
020 ACCEPT src-addr = 128.100.033.001;
030 ACCEPT dst-addr = 200.135.038.009;
040 DENY;
If you do not specify a filtering action, the default filtering action is
permit
.
Creating Filter Files To create a filter, use a text editor on your computer to create or edit a
filter file. Use the Trivial File Transfer Protocol (TFTP) to load the file in the
RAS 1500 FLASH memory. (If you TFTP an edited file to the RAS 1500, it
replaces the original file.)
Be careful, the following steps require frequent switching between your
computer and the RAS 1500. To create a filter file on your computer,
perform the following:
1 Create a new text file. Enter a file descriptor on the first line.
#filter
Eliminate blank space before the descriptor, otherwise an error will occur.
2 Enter a file section header followed by a colon to begin a protocol
section. For example, to define IP filtering rules, enter the following
section header:
IP:
If you want to comment a section header out, put a
#
(pound) sign
before the header. It is useful to insert a placeholder for a protocol
section you will define later.