3Com OfficeConnect 3C100XF, Руководство пользователя CLI

Страница: 225 / 260

Filter Examples 27-15
If you are concerned about security, filter out incoming type 5 messages. Sending
ICMP redirects is an easy way for a vandal to change your routing tables.
Although ping is useful for troubleshooting, it allows a potential intruder to obtain
a map of your network by systematically pinging every possible address. If you
think this is a security risk, filter out incoming
type 8 packets or outgoing echo
replies ( type 0 ).
For example, if you want to prevent vandals from changing your routing tables by
sending ICMP redirects, use the following filter file:
#filter
IP:
010 REJECT icmp-type = 5;
enable ip security_option
drop_all_fragoffset1
Use this command to block packets with an offset of 1. This is the default
condition.
disable ip security_option
drop_all_fragoffset1
Use this command to cease blocking packets with an offset of 1.
Global Switch to drop Packets with a Partial TCP Header
This global function allows the global configuration to discard all IP packets with a
partial TCP header. This command is similar to and a subset of the
enable ip
security drop_all_fragoffset command. The default setting is enabled meaning
these packets will be discarded. When a packet is discarded the event is syslogged.
enable ip security_option
drop_tcp_fragoffset1
Use this command to block TCP packets with an offset of 1. This is the default
condition.
disable ip security_option
drop_tcp_fragoffset1
Use this command to cease blocking TCP packets with an offset of 1.
Global Switch to Filter Out IP Source Route Options
This global option addresses the particular path a sender chooses to take through
the network to reach its destination, as specified in the sender packet’s IP header.
Using this command, you can discard packets of this type, although this is a lower
level of security than All Header Options.
enable ip security_option
disallow_source_route_op
tions
Use this command to disallow packets with IP source route options.
13 Timestamp Request
14 Timestamp Reply
15 Information Request
16 Information Reply
17 Address Mask Request
18 Address Mask Reply
Table 27-5
Type Description