HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 129 / 778

3-27
Virus Throttling (Connection-Rate Filtering)
Configuring and Applying Connection-Rate ACLs
configure a connection-rate ACL that causes the switch to ignore (circumvent)
connection-rate filtering for inbound traffic from the server, while maintaining
the filtering for all other inbound traffic on port D2.
The configuration steps include:
1. Create the connection-rate ACL with a single entry:
• Use the IP address of the desired server.
• Include a CIDR notation of “32” for the ACL mask. (Which means the
mask will allow only traffic whose source IP address (SA) exactly
matches the specified IP address.)
• The ACL will automatically include the implicit
filter
ACE as the last
entry, which means that any traffic that is not from the desired server
will be subject to filtering by the connection-rate policy configured
on port D2.
2. Assigning the ACL to the VLAN through which traffic from the server
enters the switch.
Figure 3-11. Creating and Assigning a Connection Rate ACL
HP Switch(config)# ip access-list connection-rate-filter 17-server
HP Switch(config-crf-nacl)# ignore ip host 15.45.50.17
HP Switch(config-crf-nacl)# exit
HP Switch(config)# vlan 15
HP Switch(vlan-15)# ip access-group 17-server connection-rate-filter
HP Switch(vlan-15)# exit
HP Switch(config)# write mem
Enters the connection-
rate ACL context and
names the ACL.
Configures the action to allow traffic from the server at
15.45.50.17 without filtering through the per-port connection-
rate policy configured on port D2.
Assigns the new
ACL to VLAN 15,
where traffic
from the desired
server enters the
switch.