Samsung Ubigate iBG2016, Руководство по настройке

Страница: 279 / 744

Ubigate iBG2016 Configuration Guide
© SAMSUNG Electronics Co., Ltd.
229
CHAPTER 2. Packet Filtering
Ubigate iBG2016s can be configured for MAC and IP traffic filtering
capabilities. IP traffic filtering allows creation of rule sets that selectively
block TCP/IP packets on a specified interface. Filters are applied
independently to all interfaces: Ethernet, serial, or WAN, as well as
independently to interface direction: IN(packets coming in to the Ubigate
iBG2016) or OUT(packets going out of the Ubigate iBG2016).
IP packet filtering capability can be used to restrict access to the Ubigate
iBG2016 from untrusted, external networks or from specific, internal
networks. An example would be a filter that prohibits external users from
establishing Telnet sessions to the Ubigate iBG2016, and allows only specific
internal users Telnet access to the system.
y
At the end of every rule list is an implied ‘deny all traffic’ statement.
Therefore, all packets not explicitly permitted by filtering rules, are denied.
This effectively means that once you enter a ‘deny’ statement in your filter
list, you are implicitly denying all packets from crossing the interface.
Therefore, it is important that each filter list contain at least one ‘permit’
statement.
y
The order in which you enter the filtering rules is important. As the Ubigate
iBG2016 is evaluating each packet, the SNOS tests the packet against each
rule statement sequentially. After a match is found, no more rule statements
are checked. For example, if you create a rule statement that explicitly
permits all traffic, all traffic is passed since no further rules are checked.
y
The SNOS permits easy re-ordering of filter commands through access-list
insert and delete commands.