3Com 10014299 manual Packet filtering schematic diagram

Firewall Overview 549

Figure 171 Packet filtering schematic diagram

The following can be realized by data packet filtering:

■Prohibit logging on with telnet from outside

■Every E-mail is sent by SMTP (Simple Message Transfer Protocol).

■One PC, rather than all other PCs, can send news to us by NNTP (Network News Transfer Protocol).

Packet filtering in 3Com routers security equipment features the following:

■Based on access-list (Access Control List - ACL): ACL is applied not only in packet filtering but also in other features where data streams need to be classified, such as address translation and IPSec.

■Support standard and extended ACL: Set a simple address range with the standard ACL or set the specific protocol, source address range, destination address range, source port range, destination port range, priority and service type with the extended ACL.

■Support time segment: Set ACL functions in a specific period of time, such as 8:00-2:00 of every Monday, or it can be as specific as from a year/month/day to another year/month/day.

■Support ACL automatic sorting: You can select sorting ACLs of a specific category to simplify the configuration and facilitate the maintenance.

■It can be as specific as indicating the input/output direction: For example, a special packet filtering rule can be applied in the output direction of the interface that is connected with WAN or another packet filtering rule is applied in the input direction.

■Support interface based filtering: It can be set to prohibit or permit to forward messages from a specific interface in a specific direction of an interface.

■Support creating a log for message meeting the condition: Record the related information of the message and provide a mechanism to guarantee that excessive resources are not consumed when a large number of logs are triggered in the same way.

Access Control List To filter data packets, rules need to be configured. A rule identifies a packet to be considered by an Access Control List.

The access control list is generally employed to configure the rules to filter data packets, and the types of access control lists are as follows:

■Standard access control list