Paradyne CSU, DSU, 9126-II, 9128-II manual Router Security, IP Router Filtering, Bridge Filtering

5. Configuring the FrameSaver SLV Router

Router Security

The router offers security via the following:

Filtering can be enabled or disabled for inbound and/or outbound traffic:

—Ethertype

—ICMP Message Type, Code

—IP Protocol Type: TCP, UDP, or ICMP

—TCP/UDP Ports

—IP Source/Destination IP Address Always enabled:

—Land Bug Prevention

—Smurf Attack Prevention

IP Router Filtering

Router filtering does not apply when the router is in bridge-only mode. By default, filtering is disabled on the router. Filtering provides security advantages on LANs by restricting traffic on the network. A filter consists of a set of rules applied to a specific interface to indicate whether a packet received or sent on that interface is forwarded or discarded.

Filters are configured in general router configuration mode, then applied to the Ethernet or frame relay network interface. Filters are applied to traffic in either the transmit or receive direction on that interface.

here is one filter access list per interface, per direction, with a maximum of

33 rules per list. For IP filters, all rules with a source host IP address are applied first; all rules with a destination host IP address are applied next. The remaining filters are applied in the order in which they were configured.

Bridge Filtering

Bridge filtering does not apply when the router is in router-only mode. When bridging is enabled, separate ethertype filters are applied to the Ethernet and frame relay interfaces. They are applied to traffic in either the transmit or receive direction on that interface, with one filter access list per interface, per direction.

here is a maximum of 16 rules per list. Each rule in the access list allows the user to filter a single ethertype or range of ethertypes.

MAC frames can be filtered based on the:

TSNAP Ethernet field in the 802.2 and 802.3 header. Protocol type field in the DIX Ethernet header.

For ethertype filters, the rules are applied in the order in which they were configured.

5-14 September 2002 9128-A2-GB20-80