RadiSys SEG-100, Руководство администратора

Страница: 112 / 198

6
Firewall
112
3. To include the DNS protocol to resolve URLs into IP addresses, create a separate IP rule for
DNS:
Device:/main> add IPRule Name=lan_to_wan_dns

Action=NAT SourceInterface=sfp1

SourceNetwork=sfp1_net

DestinationInterface=sfp2

DestinationNetwork=all ‐ nets ‐ ip4

Service=dns ‐ all
Activating and committing changes
After any changes are made to an SEG configuration, they will be saved as a new configuration
but will not yet be activated. To activate all the configuration changes made since the last
activation of a new configuration, the following command must be issued:
Device:/> activate
Although the new configuration is now activated, it does not become permanently activated
until the following command is issued within 30 seconds following the activate :
Device:/> commit
The reason for two commands is to prevent a configuration accidentally locking out the
administrator. If a lockout occurs, the second command will not be received and the SEG will
revert back to the original configuration after the 30 second time period. This time period is a
setting that can be changed as shown next.
Example: Changing the activation revert timeout
This example shows how to change the default revert timeout after a configuration is
activated to 120 seconds.
Device:/> set Settings RemoteMgmtSettings BiDirTimeout=120
Allowing ICMP Ping requests
It can be useful to allow ICMP Ping requests to be sent out to external hosts on the Internet.
As discussed earlier, the SEG will drop any traffic unless an IP rule explicitly allows it. This
example shows how to allow the pinging of external hosts with the ICMP protocol by
computers on the internal sfp1_net network.
1. Change the current CLI context to be the IPRuleSet called main using the command:
Device:/> cc IPRuleSet main
2. Add an IP rule called allow_ping_outbound to allow ICMP pings to pass:
Device:/main> add IPRule Name=allow_ping_outbound

Action=Allow SourceInterface=sfp1

SourceNetwork=sfp1_net

DestinationInterface=sfp2

DestinationNetwork=all ‐ nets ‐ ip4

Service=ping ‐ outbound ‐ ip4