3Com 2928 User Guide - Page 451
Fragments Filtering with IPv4 ACLs, Effective Period of an ACL
UPC - 662705557113
View all 3Com 2928 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 451 highlights
Table 1-2 Depth-first match for IPv4 ACLs IPv4 ACL category Basic IPv4 ACL Advanced IPv4 ACL Ethernet frame header ACL Depth-first match procedure 1) Sort rules by source IP address wildcard mask and compare packets against the rule configured with more zeros in the source IP address wildcard mask. 2) In case of a tie, compare packets against the rule configured first. 1) Sort rules by the protocol carried over IP. A rule with no limit to the protocol type (that is, configured with the ip keyword) has the lowest precedence. Rules each of which has a single specified protocol type are of the same precedence level. 2) If the protocol types have the same precedence, look at the source IP address wildcard mask. Then, compare packets against the rule configured with more zeros in the source IP address wildcard mask. 3) If the numbers of zeros in the source IP address wildcard masks are the same, look at their destination IP address wildcard masks. Then, compare packets against the rule configured with more zeros in the destination IP address wildcard mask. 4) If the numbers of zeros in the destination IP address wildcard masks are the same, look at the Layer 4 port number ranges, namely the TCP/UDP port number ranges. Then compare packets against the rule configured with the smaller port number range. 5) If the port number ranges are the same, compare packets against the rule configured first. 1) Sort rules by source MAC address mask first and compare packets against the rule configured with more ones in the source MAC address mask. 2) If two rules are present with the same number of ones in their source MAC address masks, look at the destination MAC address masks. Then, compare packets against the rule configured with more ones in the destination MAC address mask. 3) If the numbers of ones in the destination MAC address masks are the same, compare packets against the one configured first. The comparison of a packet against ACL rules stops immediately after a match is found. The packet is then processed as per the rule. Fragments Filtering with IPv4 ACLs Traditional packet filtering performs match operation on only the first fragments. All non-first fragments are permitted. This results in security risks, because attackers may exploit this vulnerability to fabricate non-first fragments to attack your network. As for the configuration of a rule of an IPv4 ACL, you can specify that the rule applies to non-first fragment packets only, and does not apply to non-fragment packets or the first fragment packets. ACL rules that do not contain this keyword is applicable to both non-fragment packets and fragment packets. Effective Period of an ACL You can control when a rule can take effect by referencing a time range in the rule. A referenced time range can be one that has not been created yet. The rule, however, can take effect only after the time range is defined and becomes active. 1-2