Brocade Communications Systems 5600 vRouter, Руководство по настройке

Страница: 28 / 106

Matching ICMP type names
Packets can be filtered for ICMP type names. For example, to create a rule that allows only ICMP echo request packets, perform the
following steps in configuration mode.
TABLE 8 Accepting ICMP packets with specific type names
Step Command
Set the protocol to match to ICMP.
vyatta@R1# set security firewall name ICMP-NAME
rule 40 protocol icmp
Set the ICMP packet type to match.
vyatta@R1# set security firewall name ICMP-NAME
rule 40 icmp type-name echo-request
Set the action to accept.
vyatta@R1# set security firewall name ICMP-NAME
rule 40 action accept
Commit the configuration.
vyatta@R1# commit
Show the configuration.
vyatta@R1# show security firewall name ICMP-NAME
rule 40 {
action accept
protocol icmp
icmp {
type-name echo-request
}
}
vyatta@R1#
Matching groups
Groups of addresses, ports, and networks can be defined for similar filtering. For example, to create a rule that rejects traffic to a group of
addresses and ports and from a group of networks, perform the following steps in configuration mode.
TABLE 9 Rejecting traffic based on groups of addresses, networks, and ports
Step Command
Add an address to an address group.
vyatta@R1# set resources group address-group
SERVERS address 1.1.1.7
Add a network to a address group.
vyatta@R1# set resources group address-group
SERVERS address 10.0.10.0/24
Add a port to a port group.
vyatta@R1# set resources group port-group PORTS
port 22
Add a port name to a port group.
vyatta@R1# set resources group port-group PORTS
port http
Commit the configuration.
vyatta@R1# commit
Show the configuration.
vyatta@R1# show resources
group {
Configuration Examples
Brocade 5600 vRouter Firewall Configuration Guide
28 53-1004253-01