User's Manual 15. Security
Version 4.4.3 259 MP-20x Multimedia Home Gateway
2. In the 'Matching' section, define a match between IP addresses and a traffic protocol:
a. Configure the source address of the packets sent to or received from the network
object. To add an address, select the option 'User Defined' from the drop-down
list; the screen 'Edit Network Object' appears.
Figure 15-27: Add a Specific Host
Click the New icon; this commences a sequence that adds a new network
object.
b. Configure the destination address of the packets sent to or received from the
network object. This address can be configured in the same manner as the
source address.
c. From the 'Protocol' drop-down list, select a specific traffic protocol or add a new
one (by selecting 'User Defined'); the 'Edit Services' screen appears. Click the
link New Server Ports; this commences a sequence that adds a new protocol.
3. Select the check box 'DSCP' to mark a DSCP value on packets matching this rule; the
screen refreshes, allowing you to enter the hexadecimal value of the DSCP.
4. Select the check box 'Priority' to add a priority to the rule; the screen refreshes,
allowing you to select between one of eight priority levels, zero being the lowest and
seven the highest (each priority level is mapped to low/medium/high priority). This sets
the priority of a packet on the connection matching the rule, while routing the packet.
Figure 15-28: Set Priority Rule
5. Select the check box 'Length' to specify the length of packets or the length of their
data portion.
6. In the 'Operation' section, define the action of the rule:
• Drop: Deny access to packets that match the source and destination IP
addresses and service ports defined in 'Matching'.
• Reject: Deny access to packets that match the source and destination IP
addresses and service ports defined in 'Matching' and sends and sends an ICMP
error or a TCP reset to the origination peer.
• Accept Connection: Allow access to packets that match the source and
destination IP addresses and service ports defined in 'Matching'. The data
transfer session is handled using Stateful Packet Inspection (SPI).
• Accept Packet: Allow access to packets that match the source and destination
IP addresses and service ports defined in 'Matching'. The data transfer session is
not handled using Stateful Packet Inspection (SPI), meaning that other packets
that match this rule are not automatically allowed access. For example, this can
useful when creating rules that allow broadcasting.
To Next Page
Loading...
Need help?
General
