HP J8697A, Руководство по обеспечению безопасности доступа

Страница: 249 / 390

Traffic/Security Filters
Configuring Traffic/Security Filters
Example of Creating a Source-Port Filter
For example, assume that you want to create a source-port filter that drops
all traffic received on port 5 with a destination of port trunk 1 (
Trk1
) and any
port in the range of port 10 to port 15. To create this filter you would execute
this command:
ProCurve(config)# filter source-port 5 drop trk1,10-15
Later, suppose you wanted to shift the destination port range for this filter up
by two ports; that is, to have the filter drop all traffic received on port 5 with
a destination of any port in the range of port 12 to port 17. (The
Trk1
destination
is already configured in the filter and can remain as-is.)With one command
you can restore forwarding to ports 10 and 11 while adding ports 16 and 17 to
the "drop" list:
ProCurve(config)# filter source-port 5 forward 10-11 drop
16-17
Configuring a Filter on a Port Trunk
This operation uses the same command as is used for configuring a filter on
an individual port. However, the configuration process requires two steps:
1. Configure the port trunk.
2. Configure a filter on the port trunk by using the trunk name ( trk1 , trk2 ,
... trk6 ) instead of a port name.
For example, to create a filter on port trunk 1 to drop traffic received inbound
for trunk 2 and ports 10-15:
ProCurve(config)# filter source-port trk1 drop trk2,10-15
Note that if you first configure a filter on a port and then later add the port to
a trunk, the port remains configured for filtering
but the filtering action will
be suspended while the port is a member of the trunk . That is, the trunk does
not adopt filtering from the port configuration. You must still explicitly
configure the filter on the port trunk. If you use the
show filter < index >
command for a filter created before the related source port was added to a
trunk, the port number appears between asterisks (
*
), indicating that the
filter action has been suspended for that filter. For example, if you create a
9-19