HP A7533A - Brocade 4Gb SAN Switch Base, Руководство администратора

Страница: 140 / 576

138 Configuring advanced security features
A switch with Fabric OS 5.3.0 or later will have a default IP Filter policy for IPv4 and IPv6. The default IP
Filter policy cannot be deleted or changed. When an alternative IP Filter policy is activated, the default IP
Filter policy becomes deactivated. Table 33 lists the rules of the default IP Filter policy.
IP Filter policy enforcement
An active IP Filter policy is a filter applied to the IP packets through the management interface. IPv4
management traffic passes through the active IPv4 filter policy, and IPv6 management traffic passes
through the active IPv6 filter policy. The IP Filter policy applies to the incoming (ingress) management traffic
only. When a packet arrives, it is compared against each rule, starting from the first rule. If a match is
found for the source address, destination port, and protocol, the corresponding action for this rule is taken,
and the subsequent rules in this policy are ignored. If there is no match, it is compared to the next rule in
the policy. This process continues until the incoming packet is compared to all rules in the active policy.
If none of the rules in the policy match the incoming packet, the two implicit rules are matched to the
incoming packet. If the rules still do not match the packet, the default action, which is to deny, is taken.
When the IPv4 or IPv6 address for the management interface of a switch is changed through the
ipAddrSet
command or manageability tools, the active IP Filter policies automatically become enforced
on the management IP interface with the changed IP address.
NOTE: If a switch is part of a LAN behind a Network Address Translation (NAT) server, depending on the
NAT server configuration, the source address in an IP Filter rule may have to be the NAT server address.
Adding a rule to an IP Filter policy
There can be a maximum of 256 rules created for an IP Filter policy. The change to the specified IP Filter
policy is not saved to the persistent configuration until a save or activate subcommand is run.
1. Log in to the switch using an account assigned to the admin role.
2. Enter the following command:
ipfilter --addrule <policyname> -rule <rule_number> -sip <source IP> -dp
<dest port> -proto <protocol> -act <permit | deny>
Table 33 Default IP policy rules
Rule number Source
address
Destination
port
Protocol Action
1 Any 22 TCP Permit
2 Any 23 TCP Permit
3 Any 897 TCP Permit
4 Any 898 TCP Permit
5 Any 111 TCP Permit
6 Any 80 TCP Permit
7 Any 443 TCP Permit
9 Any 161 UDP Permit
10 Any 111 UDP Permit
11 Any 123 UDP Permit
12 Any 600-1023 UDP Permit
where:
policyname
Specifies the policy name which is a unique string composed of a
maximum of 20 alphanumeric and underscore characters. The names
default_ipv4 and default_ipv6 are reserved for the default IP Filter policies.
The policy name is case-insensitive and always stored as lowercase.