![background image](http://html1.mh-extra.com/html/3com/officeconnect-3c100xf/officeconnect-3c100xf_cli-users-manual_440829184.webp)
22-2
C
HAPTER
22: IPS
EC
C
OMMANDS
CLI Commands
Enable Command
enable ip security_option
The
enable ip_security option
command has the following parameters.
drop_all_fragoffset1
drop_tcp_fragoffset1
disallow_all_header_options
disallow_source_route_options
This security feature also syslogs the event when the packet is dropped. See the
show packet_logging settings
command for accounting data.
Disallow and drop commands work in conjunction with each other. The
disallow_source_route_options
command is a subset of the
disallow_all_header_options
command. If you enable the
source route
command you must disable the all header command. But, enabling the more
inclusive all header value renders the
source route
command unnecessary
whether enabled or not. The same logic holds true for drop commands.
Each parameter of the
enable ip_security option
command allows global
filtering of all IP packets containing the following datagram fields. These datagram
fields, when found, cause the packet to be dropped.
fragment offset=1
partial TCP headers
all header options
source route options
fragment offset=1
Packets with an offset equal to one are discarded in accordance with RFC
1858. Some routers that may be used on the same network with the
OfficeConnect Gateway may be configured to filter out specific traffic. In
some cases these routers will not apply the filter correctly for IP packets with
an offset of 1. To avoid this limitation in the filtering mechanism, packets of
this type can be discarded. Of the two drop commands, this is the highest
level of security. The default is
enabled
.
partial TCP headers (offset=1)
Protocol field in the IP packet header (in this case, TCP). Packets of this type
can be discarded. Lower level of security than All fragmented packets
(Drop_all_fragoffset1). The default is
enabled
.
all header options
All choices in the IP Options field of the IP header. IP options may be
generated as an attack to get past routing tables. To avoid this limitation in
security, packets of this type can be discarded. Of the two disallow
commands, this is the highest level of security. The default is
disabled
.
Содержание OfficeConnect 3C100XF
Страница 1: ...http www 3com com OfficeConnect Gateway CLI User s Guide Release 1 0 Part No 10042302 Rev AA ...
Страница 14: ...xiv ...
Страница 18: ...iv ABOUT THIS GUIDE ...
Страница 30: ...1 12 CHAPTER 1 USING THE COMMAND LINE INTERFACE CLI ...
Страница 50: ...3 14 CHAPTER 3 ADMINISTRATIVE CLI COMMANDS ...
Страница 58: ...4 8 CHAPTER 4 CONFIGURING AND MANAGING USERS ...
Страница 70: ...6 8 CHAPTER 6 BRIDGING COMMANDS ...
Страница 78: ...8 4 CHAPTER 8 INTERFACE COMMANDS ...
Страница 82: ...9 4 CHAPTER 9 ARP COMMANDS ...
Страница 88: ...11 4 CHAPTER 11 DHCP COMMANDS ...
Страница 124: ...12 36 CHAPTER 12 IP ROUTING COMMANDS ...
Страница 134: ...13 10 CHAPTER 13 DNS COMMANDS ...
Страница 142: ...15 6 CHAPTER 15 MULTICASTING AND IGMP COMMANDS ...
Страница 160: ...17 8 CHAPTER 17 PPP COMMANDS ...
Страница 182: ...21 6 CHAPTER 21 ADDRESS TRANSLATION COMMANDS ...
Страница 186: ...22 4 CHAPTER 22 IPSEC COMMANDS ...
Страница 188: ...23 2 CHAPTER 23 SECURITY ASSOCIATION SA COMMANDS ...
Страница 192: ...24 4 CHAPTER 24 TCP COMMANDS ...
Страница 204: ...25 12 CHAPTER 25 SNMP COMMANDS ...
Страница 210: ...26 6 CHAPTER 26 IP FILTERS COMMANDS ...
Страница 238: ...29 6 CHAPTER 29 TRACEROUTE COMMANDS ...
Страница 255: ...xv RFC 1483 16 3 RFC 1483 MER 16 4 ...
Страница 256: ...xvi ...
Страница 260: ......