Manualshelf

HP VPN Firewall Appliances Network Management Configuration Guide

ManualsBrandsHP ManualsComputer AccessoriesHP ProCurve Switch xl Access Controller Module
691692693694695696697698699700
671
[RouterC-msdp] quit
# Configure an MSDP peer on the firewall.
[Firewall] msdp
[Firewall-msdp] peer 10.110.5.1 connect-interface gigabitethernet 0/3
[Firewall-msdp] quit
5. Configure SA message filtering rules:
# Configure an SA message filter on Router C so that Router C will not forward SA messages for
(Source 1, 225.1.1.0/30) to the firewall.
[RouterC] acl number 3001
[RouterC-acl-adv-3001] rule deny ip source 10.110.3.100 0 destination 225.1.1.0
0.0.0.3
[RouterC-acl-adv-3001] rule permit ip source any destination any
[RouterC-acl-adv-3001] quit
[RouterC] msdp
[RouterC-msdp] peer 10.110.5.2 sa-policy export acl 3001
[RouterC-msdp] quit
# Configure an SA message filter on the firewall so that the firewall will not create SA messages
for Source 2.
[Firewall] acl number 2001
[Firewall-acl-basic-2001] rule deny source 10.110.6.100 0
[Firewall-acl-basic-2001] quit
[Firewall] msdp
[Firewall-msdp] import-source acl 2001
[Firewall-msdp] quit
Verifying the configuration
# Display the (S, G) entries cached in the SA cache on Router C.
[RouterC] display msdp sa-cache
MSDP Source-Active Cache Information of VPN-Instance: public net
MSDP Total Source-Active Cache - 8 entries
MSDP matched 8 entries
(Source, Group) Origin RP Pro AS Uptime Expires
(10.110.3.100, 225.1.1.0) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 225.1.1.1) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 225.1.1.2) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 225.1.1.3) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 226.1.1.0) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 226.1.1.1) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 226.1.1.2) 1.1.1.1 ? ? 02:03:30 00:05:31
(10.110.3.100, 226.1.1.3) 1.1.1.1 ? ? 02:03:30 00:05:31
# Display the (S, G) entries cached in the SA cache on the firewall.
[Firewall] display msdp sa-cache
MSDP Source-Active Cache Information of VPN-Instance: public net
MSDP Total Source-Active Cache - 4 entries
MSDP matched 4 entries
(Source, Group) Origin RP Pro AS Uptime Expires