User's Manual 14. Security
Version 4.4.0 275 MP26x/MP27x
2. In the section 'Matching', define a match between IP addresses and a traffic protocol:
a. Configure the source address of the packets sent to or received from the network
object. To add an address, select the option 'User Defined' from the drop-down
list; the screen 'Edit Network Object' appears.
Figure 14-27: Add a Specific Host
Click the New icon; this commences a sequence that adds a new network
object.
b. Configure the destination address of the packets sent to or received from the
network object. This address can be configured in the same manner as the
source address.
c. From the 'Protocol' drop-down list, select a specific traffic protocol or add a new
one (by selecting 'User Defined'); the 'Edit Services' screen appears. Click the
link New Server Ports; this commences a sequence that adds a new protocol.
3. Select the check box 'DSCP' to mark a DSCP value on packets matching this rule; the
screen refreshes, allowing you to enter the hexadecimal value of the DSCP.
4. Select the check box 'Priority' to add a priority to the rule; the screen refreshes,
allowing you to select between one of eight priority levels, zero being the lowest and
seven the highest (each priority level is mapped to low/medium/high priority). This sets
the priority of a packet on the connection matching the rule, while routing the packet.
Figure 14-28: Set Priority Rule
5. Select the check box 'Length' to specify the length of packets or the length of their
data portion.
6. In the section 'Operation', define the action of the rule:
• Drop: Deny access to packets that match the source and destination IP
addresses and service ports defined in 'Matching'.
• Reject: Deny access to packets that match the source and destination IP
addresses and service ports defined in 'Matching' and sends and sends an ICMP
error or a TCP reset to the origination peer.
• Accept Connection: Allow access to packets that match the source and
destination IP addresses and service ports defined in 'Matching'. The data
transfer session is handled using Stateful Packet Inspection (SPI).
To Next Page
Loading...
Need help?
General
