5. Configuring the FrameSaver DSL Router
9700-A2-GB20-20 December 2002 5-15
Router Security
The router offers security via the following:
Filtering can be enabled or disabled for inbound and/or outbound traffic:
— Ethertype
— ICMP Message Type, Code
— IP Protocol Type: TCP, UDP, or ICMP
— TCP/UDP Ports
— IP Source/Destination IP Address
Always enabled:
— Land Bug Prevention
— Smurf Attack Prevention

IP Router Filtering

Router filtering does not apply when the router is in bridge-only mode. By default,
filtering is disabled on the router. Filtering provides security advantages on LANs
by restricting traffic on the network. A filter consists of a set of r ules applied to a
specific interface to indicate whether a packet received or sent on that interface is
forwarded or discarded.
Filters are configured in general router configuration mode, then applied to the
Ethernet or frame relay network interface. Filters are applied to traffic in either the
transmit or receive direction on that interface.
There is one filter access list per interface, per direction, with a maximum of
33 rules per list. For IP filters, all rules with a source host IP address are applied
first; all rules with a destination host IP address are applied next. The rem aining
filters are applied in the order in which they were configured.

Bridge Filtering

Bridge filtering does not apply when the router is in router-on ly mode. When
bridging is enabled, separate ethertype filters are applied to the Eth ernet and
frame relay interfaces. They are applied to traffic in either the transmit or receive
direction on that interface, with one filter access list per interface, per direction.
There is a maximum of 16 rules per list. Each rule in the access list allows the user
to filter a single ethertype or range of ethertypes.
MAC frames can be filtered based on the:
SNAP Ethernet field in the 802.2 and 802.3 header.
Protocol type field in the DIX Ethernet header.
For ethertype filters, the rules are applied in the order in which they were
configured.