HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 489 / 778

10-69
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
[established] — This option applies only where TCP is the
configured protocol type. It blocks the synchronizing packet
associated with establishing a TCP connection in one direction
on a VLAN while allowing all other IPv4 traffic for the same
type of connection in the opposite direction. For example, a
Telnet connect requires TCP traffic to move both ways between
a host and the target device. Simply applying a
deny to inbound
Telnet traffic on a VLAN would prevent Telnet sessions in either
direction because responses to outbound requests would be
blocked. However, by using the
established option, inbound
Telnet traffic arriving in response to outbound Telnet requests
would be permitted, but inbound Telnet traffic trying to estab-
lish a connection would be denied.
TCP Control Bits. In a given ACE for filtering TCP traffic
you can configure one or more of these options:
[ ack ]
— Acknowledgement.
[ fin ] — Sender finished.
[ rst ]
— Connection reset.
[ syn ] — TCP control bit: sequence number synchronize.
For more on using TCP control bits, refer to RFC 793.