Alcatel OS6400-24 Guía de usuario descargar pdf (Pagina 14)

August 2008

Page 14 of 55 OmniSwitch 6400------ Release 6.3.3.R01

ACL & Layer 3 Security

The following additional ACL features are available for improving network security and preventing mali-

cious activity on the network:

• ICMP drop rules—Allows condition combinations in policies that will prevent user pings, thus

reducing DoS exposure from pings. Two condition parameters are also available to provide more

granular filtering of ICMP packets: icmptype and icmpcode.

• TCP connection rules—Allows the determination of an established TCP connection by examining

TCP flags found in the TCP header of the packet. Two condition parameters are available for defining

a TCP connection ACL: established and tcpflags.

• Early ARP discard—ARP packets destined for other hosts are discarded to reduce processing over-

head and exposure to ARP DoS attacks. No configuration is required to use this feature, it is always

available and active on the switch. Note that ARPs intended for use by a local subnet, AVLAN, and

VRRP are not discarded.

• UserPorts—A port group that identifies its members as user ports to prevent spoofed IP traffic. When

a port is configured as a member of this group, packets received on the port are dropped if they contain

a source IP network address that does not match the IP subnet for the port.

• UserPorts Profile—In addition to spoofed traffic, it is also possible to configure a global UserPorts

profile to specify additional types of traffic, such as BPDU, RIP, OSPF, DVMRP, PIM, DHCP server

response packets and DNS, to monitor on user ports. The UserPorts profile also determines whether

user ports will filter the unwanted traffic or will administratively shutdown when the traffic is

received. Note that this profile only applies to those ports that are designated as members of the

UserPorts port group.

• DropServices—A service group that improves the performance of ACLs that are intended to deny

packets destined for specific TCP/UDP ports. This group only applies to ports that are members of the

UserPorts group. Using the DropServices group for this function minimizes processing overhead,

which otherwise could lead to a DoS condition for other applications trying to use the switch.

ACL Manager

The Access Control List Manager (ACLMAN) is a function of the Quality of Service (QoS) application

that provides an interactive shell for using common industry syntax to create ACLs. Commands entered

using the ACLMAN shell are interpreted and converted to Alcatel-Lucent CLI syntax that is used for

creating QoS filtering policies.

This implementation of ACLMAN also provides the following features:

• Importing of text files that contain common industry ACL syntax.

• Support for both standard and extended ACLs.

• Creating ACLs on a single command line.

• The ability to assign a name, instead of a number, to an ACL or a group of ACL entries.

• Sequence numbers for named ACL statements.

1 2 ... 9 10 11 12 13 14 15 16 17 18 19 ... 54 55

Sin comentarios

Alcatel OS6400-24 Guía de usuario Pagina 14