ELTEX ESR Series, Руководство пользователя

Страница: 397 / 575

ESR-Series. User manual
397
Step Description Command Keys
41 Set the limitation under which the rule
will only work for traffic modified by the
IP address and destination ports
translation service. esr(config-zone-rule)# match [not]
destination-nat
42 Set the maximum packet rate (optional,
available only for zone-pair any self and
zone-pair <zone-name> any). esr(config-zone-pair-rule)# rate-
limit pps <rate-pps> <rate-pps> – maximum amount
of packets that can be
transmitted. Takes values in
the range of [1..10000].
43 Set the filtration only for fragmented IP
packets (optional, available only for
zone-pair any self and zone-pair <zone-
name> any). esr(config-zone-pair-rule)# match
[not] fragment
44 Set the filtration only for IP packets
including ip-option (optional, available
only for zone-pair any self and zone-pair
<zone-name> any). esr(config-zone-pair-rule)# match
[not] ip-option
45 Create an interzone interaction rule. esr(config-zone-rule)# enable
46 Enable filtering and session tracking
mode while packets are transmitted
between one Bridge group participants
(optional, available only for
ESR-1000/1200/1500/1511/1700
/3100) esr(config-bridge)# ports firewall
enable
1
When using the not key, the rule will work for values which are not included in a specified profile.
Each “match” command may contain “not” key. When using the key, packets that do not meet the given
requirement will fall under the rule.
You can obtain more detail information about firewall configuration in “CLI command reference guide”.
13.4.2 Firewall configuration example
Objective:
Enable message passage via ICMP between R1, R2 and ESR router.