To Next Page

To Previous Page

3-19

Virus Throttling (Connection-Rate Filtering)

Configuring and Applying Connection-Rate ACLs

Figure 3-6. Connection-Rate ACL Applied to Traffic Received Through a Given Port

Configuring a Connection-Rate ACL Using

Source IP Address Criteria

(To configure a connection-rate ACL using UDP/TCP criteria, go to page 3-21.)

Syntax: ip access-list connection-rate-filter < crf-list-name >

Creates a connection-rate-filter ACL and puts the CLI

into the access control entry (ACE) context:

HP Switch(config-crf-nacl)#

If the ACL already exists, this command simply puts the

CLI into the ACE context.

Syntax: < filter | ignore > ip < any | host < ip-addr > | ip-addr < mask-length > >

Used in the ACE context (above) to specify the action of

the connection-rate ACE and the source IP address of the

traffic that the ACE affects.

Inbound IP traffic from Host “A”

with relatively high number of IP

connection-rate attempts

Source Match

on any ACE in

the ACL?

Ignore

Filter?

Apply per-port connection-rate

policy to Host “A” traffic:

–Notify-Only

– Throttle

–Block

Apply Implicit ACE

(filter)

Filter

Allow traffic from Host

“A” without filtering

through per-port

connection-rate policy

Yes

Ignore

HP J9574A Access Security Guide

Other manuals for HP J9574A