Extreme Networks Altitude 4000 Series, Справочное руководство, Страница: 304 / 521

Chapter 8: Security Configuration
Altitude
TM
4000 Series Access Point System Reference Guide
304
19 Select the Enable Stateful DHCP Checks radio button to enable the stateful checks of DHCP packet
traffic through the Firewall. The default setting is enabled. When enabled, all DHCP traffic flows are
inspected.
20 Define Flow Timeout intervals for the following flow types impacting the Firewall:
21 Refer to the TCP Protocol Checks field to set the following parameters:
22 Select OK to update the Firewall Policy Advanced Settings. Select Reset to revert to the last saved
configuration. The Firewall policy can be invoked at any point in the configuration process by
selecting Activate Firewall Policy from the upper, left-hand side, of the access point user interface.
Configuring IP Firewall Rules
“Wireless Firewall”
Access points use IP based Firewalls like Access Control Lists (ACLs) to filter/mark packets based on the
IP address rom which they arrive, as opposed to filtering packets on Layer 2 ports.
TCP Close Wait
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 30 seconds.
TCP Established
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 10,800 seconds.
TCP Reset
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 10 seconds.
TCP Setup
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 10 seconds.
Stateless TCP Flow
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 90 seconds.
Stateless FIN/RESET
Flow
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 10 seconds.
ICMP
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 30 seconds.
UDP
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 90 seconds.
Any Other Flow
Define a flow timeout value in either Seconds (1 - 32,400), Minutes
(1 - 540) or Hours (1 - 9). The default setting is 300 seconds.
Check TCP states
where a SYN packet
tears down the flow
Select the checkbox to allow a SYN packet to delete an old flow in
TCP_FIN_FIN_STATE and TCP_CLOSED_STATE and create a new
flow. The default setting is enabled.
Check unnecessary
resends of TCP
packets
Select the checkbox to enable the checking of unnecessary resends of
TCP packets. The default setting is enabled.
Check Sequence
Number in ICMP
Unreachable error
packets
Select the checkbox to enable sequence number checks in ICMP
unreachable error packets when an established TCP flow is aborted.The
default setting is enabled.
Check
Acknowledgment
Number in RST
packets
Select the checkbox to enable the checking of the acknowledgment
number in RST packets which aborts a TCP flow in the SYN state. The
default setting is enabled.
Check Sequence
Number in RST
packets
Select the checkbox to check the sequence number in RST packets
which abort an established TCP flow. The default setting is enabled.