Alcatel-Lucent OmniAccess 700, Руководство по настройке CLI

Страница: 876 / 1193

Generic Routing Encapsulation
Left running head:
Chapter name (automatic)
850
Beta Beta
CLI Configuration Guide
Alcatel-Lucent
O
N
OA700-1
In conjunction with above configuration, define the filters as follows:
1. Configure rule using match-list to permit all traffic only from 10.3.3.1/24 network.
2. Configure filter by performing actions of permit/deny on the rules configured
above.
3. Apply filters configured to the tunnel interface.
a) Configure rules
ALU-1(config)#match-list permit-traffic
ALU-1(config-match-list-permit-traffic)#ip prefix 10.3.3.1/
24 any
ALU-1(config-match-list-permit-traffic)#exit
b) Configure filter
ALU-1(config)#ip filter tr-access
ALU-1(config-filter-tr-access)#match any permit-traffic
permit log
ALU-1(config-filter-tr-access)#exit
c) Apply the filter to the tunnel interface in the ingress direction
ALU-1(config)#interface tunnel1
ALU-1(config-if tunnel1)#ip filter in tr-access
ALU-1(config-if tunnel1)#exit
Create Firewall Policy for protecting the network against DOS attacks
1. Configure a rule using match-list for any packet that matches classification.
2. Create an attack policy, which includes the signature against DoS attack.
3. Create a firewall policy, which uses the rule and attack policy created earlier.
4. Apply the firewall policy to the tunnel interface.
a) Configure a rule for protecting the network against DoS attack
ALU-1(config)#match-list dos
ALU-1(config-match-list-dos)#ip any any
ALU-1(config-match-list-dos)#exit
b) Create attack policy
ALU-1(config)#firewall
ALU-1(config-firewall)#attack atk1
ALU-1(config-firewall-attack-atk1)#all
ALU-1(config-firewall-attack-atk1)#exit
c) Create firewall policy
ALU-1(config)#policy p1
ALU-1(config-fiewall-p1)#match dos attack atk1 drop
ALU-1(config-fiewall-p1)#exit
d) Apply the firewall policy to the tunnel interface in the ingress direction
ALU-1(config)#interface tunnel 1
ALU-1(config-if tunnel1)#firewall policy in p1
ALU-1(config-if tunnel1)#exit