Alcatel 9000 Guía de usuario descargar pdf (Pagina 579)

100

101

Configuring ACLs Using ACL Security Features

OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006 page 27-15

Configuring UserPort Traffic Types and Port Behavior

In addition to spoofed traffic, it is also possible to configure QoS to look for BPDU, RIP, OSPF, and/or

BGP packets on user ports. When the specified type of traffic is encountered, the user port can either filter

the traffic or administratively shutdown to block all traffic.

By default spoofed traffic is filtered on user ports. To specify additional types of traffic to look for on

these ports and select how the port will deal with such traffic, use the qos user-port command to config-

ure a UserPorts profile. For example, the following command specifies that user ports should filter BPDU

packets:

-> qos user-port filter spoof

To specify multiple types of traffic on the same command line, enter each type separated by a space. For

example:

-> qos user-port filter ospf /jointfilesconvert/219251/bgp rip

Note that a slot and port is not required with the qos user-port command. This is because the command

applies to all ports that are members of the UserPorts group.

The following qos user-port command example uses the shutdown option to administratively disable the

user port if the specified type of traffic is received on that port:

-> qos user-port shutdown bpdu

Note that an SNMP trap is sent whenever a user port shutdown occurs. To enable a port disabled by a user

port shutdown operation, use the interfaces admin command to administratively enable the port or

disconnect and reconnect the port cable.

To disable the filter or shutdown function, use the no form of the qos user-port command. For example,

the following command disables the filtering operation for all user ports:

-> qos no user-port filter

Note that any changes to the UserPorts profile (e.g., adding or removing a traffic type) are not made until

the qos apply command is performed.

Configuring a DropServices Group

To drop packets destined for specific TCP and UDP ports using minimal switch resources, configure a

services group called DropServices with a list of previously defined TCP/UDP services. The DropSer-

vices group is used in conjunction with the UserPorts group. TCP/UDP services that belong to the DropS-

ervices group are only filtered on ports that belong to the UserPorts group.

Note that it is not necessary to include the DropServices group in an ACL for the group to take effect.

DropServices is a reserved group that is active once TCP/UDP services are added to the group and ports

are added to the reserved UserPorts group and the QoS configuration is applied. For example:

1 Create destination port services for the TCP/UDP traffic that you want dropped using the policy

service command, as shown below:

-> policy service tcp135 destination tcp port 135

-> policy service tcp445 destination tcp port 445

-> policy service udp137 destination udp port 137

-> policy service udp138 destination udp port 138

-> policy service udp445 destination udp port 445

1 2 ... 574 575 576 577 578 579 580 581 582 583 584 ... 701 702

Comentarios a estos manuales

Sin comentarios

Alcatel 9000 Guía de usuario Pagina 579

Comentarios a estos manuales

Relacionado con productos y manuales para Software Alcatel 9000