Cabletron Systems SmartSwitch 8-slot, Руководство пользователя

Страница: 138 / 150

Chapter 9: Security Configuration Guide
9 - 14 SSR User Reference Manual
Before enabling ACL Logging, one should consider its impact on performance. With
ACL Logging enabled, the router prints out a message at the console before the packet
is actually forwarded or dropped. Even if the console is connected to the router at a
high baud rate, the delay caused by the console message is still significant. This can
get worse if the console is connected at a low baud rate, for example, 1200 baud.
Furthermore, if a Syslog server is configured then a Syslog packet must also be sent to
the Syslog server, creating additional delay. Therefore, one should consider the
potential performance impact before turning on ACL Logging.
Maintaining ACLs offline using TFTP or RCP
The SSR provides two mechanisms to maintain and manipulate ACLs. The traditional
method used by some of the other popular routers require the use of TFTP or RCP. With
this mechanism, the administrator is encouraged to create and modify ACLs on a
remote host. The administrator can use his or her favorite editor to edit, delete, replace
or reorder ACL rules in a file. Once the changes are made, the administrator can then
download the ACLs to the router using TFTP or RCP and make them take effect on the
running system.
The following example describes how one can use TFTP to help maintain ACLs on the
SSR. Suppose the following ACL commands are stored in a file on some hosts:
no acl *
acl 101 deny tcp 10.11.0.0/16 10.12.0.0/16
acl 101 permit tcp 10.11.0.0 any
acl 101 apply interface ssr12 input
The first command,
no acl *
, negates all commands that start with the keyword,
“acl”. This tells the router to remove the application and the definition of any ACL.
The administrator can be more selective if he or she wants to remove only ACL
commands related to, for instance, ACL 101 by saying,
no acl 101 *
. The negation
of all related ACL commands is important because it removes any potential confusion
caused by the addition of new ACL rules to existing rules. Basically, the
no acl
command cleans up the system for the new ACL rules.
Once the negation command is executed, the second and the third commands proceed
to redefine ACL 101. The final command applies the ACL to interface ssr12.
If the changes are accessible from a TFTP server, one can download and make the
changes take effect by issuing commands like the following:
copy tftp://10.1.1.12/config/acl.changes to scratchpad
copy scratchpad to active