HP VPN Firewall Appliances Access Control Configuration Guide

133
Figure 107 Adding an ASPF policy
4. Configure the parameters as described in Table 40.
5. Click Apply.
Table 40 Configuration items
Item Descri
p
tion
Source Zone
Select a source/destination zone to which the ASPF policy will be applied..
Dest Zone
Discard ICMP error packets
Set whether to discard ICMP error packets.
If this box is not selected, ICMP error packets are allowed to pass.
Discard non-SYN initial TCP
packets
Set whether to discard initial TCP packets that are not SYN packets.
If this box is not selected, initial TCP packets that are not SYN packets are
allowed to pass.
ASPF configuration example
Network requirements
As shown in Figure 108, configure an ASPF policy between zone 1 and zone 2 to discard ICMP error
packets but permit initial TCP packets that are not SYN packets.
Figure 108 Network diagram