Alcatel 9000 Betriebsanweisung PDF herunterladen (Seite 578)

Using ACL Security Features Configuring ACLs

page 27-14 OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006

Using ACL Security Features

The following additional ACL features are available for improving network security and preventing mali-

cious activity on the network:

• UserPorts—A port group that identifies its members as user ports to prevent spoofed IP traffic. When

a port is configured as a member of this group, packets received on the port are dropped if they contain

a source IP network address that does not match the IP subnet for the port. It is also possible to config-

ure a UserPorts profile to specify other types of traffic to monitor on user ports. See “Configuring a

UserPorts Group” on page 27-14. Note that this group is not supported on the OmniSwitch 6800.

• DropServices—A service group that improves the performance of ACLs that are intended to deny

packets destined for specific TCP/UDP ports. This group only applies to ports that are members of the

UserPorts group. Using the DropServices group for this function minimizes processing overhead,

which otherwise could lead to a DoS condition for other applications trying to use the switch. See

“Configuring a DropServices Group” on page 27-15. Note that this group is not supported on the

OmniSwitch 6800.

• BPDUShutdownPorts—A port group that identifies its members as ports that should not receive

BPDUs. If a BPDU is received on one of these ports, the port is administratively disabled. Note that

this group is not supported on the OmniSwitch 6850 and 9000. See “Configuring a BPDUShutdown-

Ports Group” on page 27-16.

• ICMP drop rules—Allows condition combinations in policies that will prevent user pings, thus reduc-

ing DoS exposure from pings. Two condition parameters are also available to provide more granular

filtering of ICMP packets: icmptype and icmpcode. See “Configuring ICMP Drop Rules” on

page 27-17.

• TCP connection rules—Allows the determination of an established TCP connection by examining

TCP flags found in the TCP header of the packet. Two condition parameters are available for defining

a TCP connection ACL: established and tcpflags. See “Configuring TCP Connection Rules” on

page 27-17.

• Early ARP discard—ARP packets destined for other hosts are discarded to reduce processing over-

head and exposure to ARP DoS attacks. No configuration is required to use this feature, it is always

available and active on the switch. Note that ARPs intended for use by a local subnet, AVLAN, VRRP,

and Local Proxy ARP are not discarded.

Configuring a UserPorts Group

To prevent IP address spoofing and/or other types of traffic on specific ports, create a port group called

UserPorts and add the ports to that group. For example, the following policy port group command adds

ports 1/1-24, 2/1-24, 3/1, and 4/1 to the UserPorts group:

-> policy port group UserPorts 1/1-24 2/1-24 3/1 4/1

-> qos apply

Note that the UserPorts group applies to both bridged and routed traffic, and it is not necessary to include

the UserPorts group in a condition and/or rule for the group to take effect. Once ports are designated as

members of this group, IP spoofed traffic is blocked while normal traffic is still allowed on the port.

The UserPorts group is also used in conjunction with the DropServices group. If a flow received on a port

that is a member of the UserPorts group is destined for a TCP or UDP port (service) specified in the

DropServices group, the flow is dropped. See “Configuring a DropServices Group” on page 27-15 for

more information.

1 2 ... 573 574 575 576 577 578 579 580 581 582 583 ... 701 702

Kommentare zu diesen Handbüchern

Keine Kommentare

Alcatel 9000 Betriebsanweisung Seite 578

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Software Alcatel 9000