Manual

5. Configuring the FrameSaver SLV Router
5-14
September 2002 9128-A2-GB20-80
Router Security
The router offers security via the following:
Filtering can be enabled or disabled for inbound and/or outbound traffic:
— Ethertype
— ICMP Message Type, Code
— IP Protocol Type: TCP, UDP, or ICMP
— TCP/UDP Ports
— IP Source/Destination IP Address
Always enabled:
— Land Bug Prevention
— Smurf Attack Prevention
IP Router Filtering
Router filtering does not apply when the router is in bridge-only mode. By default,
filtering is disabled on the router. Filtering provides security advantages on LANs
by restricting traffic on the network. A filter consists of a set of rules applied to a
specific interface to indicate whether a packet received or sent on that interface is
forwarded or discarded.
Filters are configured in general router configuration mode, then applied to the
Ethernet or frame relay network interface. Filters are applied to traffic in either the
transmit or receive direction on that interface.
There is one filter access list per interface, per direction, with a maximum of
33 rules per list. For IP filters, all rules with a source host IP address are applied
first; all rules with a destination host IP address are applied next. The remaining
filters are applied in the order in which they were configured.
Bridge Filtering
Bridge filtering does not apply when the router is in router-only mode. When
bridging is enabled, separate ethertype filters are applied to the Ethernet and
frame relay interfaces. They are applied to traffic in either the transmit or receive
direction on that interface, with one filter access list per interface, per direction.
There is a maximum of 16 rules per list. Each rule in the access list allows the user
to filter a single ethertype or range of ethertypes.
MAC frames can be filtered based on the:
SNAP Ethernet field in the 802.2 and 802.3 header.
Protocol type field in the DIX Ethernet header.
For ethertype filters, the rules are applied in the order in which they were
configured.