R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

104
Figure 103 Adding an ASPF policy
4. Configure the parameters as described in Table 41.
5. Click Apply.
Table 41 Configuration items
Item Descri
p
tion
Source Zone
Select a source/destination zone to which the ASPF policy will be
applied.
Dest Zone
Discard ICMP error packets
Set whether to discard ICMP error packets
If this box is not selected, ICMP error packets are allowed to pass.
Discard non-SYN initial TCP packets
Set whether to discard initial TCP packets that are not SYN packets
If this box is not selected, initial TCP packets that are not SYN packets
are allowed to pass.
ASPF configuration example
Network requirements
As shown in Figure 104, configure an ASPF policy between zone 1 and zone 2 to discard ICMP error
packets but permit initial TCP packets that are not SYN packets.
Figure 104 Network diagram