Digi TransPort WR11, Руководство пользователя

Страница: 712 / 866

Configure security settings Firewall
Digi TransPort WR Routers User Guide 707
UDP example
pass in
pass out
pass out on ppp 1 proto udp from any to 156.15.0.0/16 port=1234
inspect-state oos ppp 1 300 t=10 c=2 d=2
The first two rules simply configure the router to allow any type of packets to be transmitted or
received (the default action of the firewall is to block all traffic).
The third rule is more complex:
▪
It configures the stateful inspection engine to watch for UDP packets (with any source address)
being routed via the PPP 1 interface to any address that begins with 156.15 on port 1234 .
▪
If a hit occurs on this rule, but the router does not detect a reply within 10 seconds (as specified
by the t= parameter), it increments an internal counter.
▪
When this counter reaches the value set by the c= parameter, the stateful inspection engine
marks the PPP 1 interface (and therefore any routes using it), as being out of service for 300
seconds.
▪
Similarly, if this counter matches the d= parameter, the stateful inspection engine deactivates
PPP 1 .
▪
The stateful inspection engine marks any routes that use PPP 1 as out of service AND
deactivates PPP 1 if no reply is detected within 10 seconds for two packets in a row.
▪
Routes come back into service when either the specified timeout expires or if there are no other
routes with a higher metric in service.
▪
PPP interfaces re-activate when the routes using them are back in service and there is a packet
to route and the AODI mode parameter is set to On .
TCP example
pass out log break end on ppp 3 proto tcp from any to 192.168.0.1
flags S!A inspect-state oos 30 t=10 c=2 d=2
pass in
pass out
▪
This rule specifically traces attempts to open a TCP connection on PPP 3 to the 192.168.0.1 IP
address and if it fails within 10 seconds twice in a row, will cause the PPP 3 interface to be
flagged as out of service (such as its metric will be set to 16), for 30 seconds.
▪
The optional d=2 entry also deactivates the PPP link. Deactivating the link can be useful in
scenarios where renegotiating the PPP connection is likely to resolve the problem.
▪
If a matching route with a higher metric is defined, the router uses it while PPP 3 routes are out
of service, thus providing a powerful route backup mechanism.