Cradlepoint IBR1100 User Manual page 80

User Manual / IBR1100/IBR1150
• Source: Select defined identities or enter
individual criteria for the appropriate Host, Port
and MAC address columns to match the source
of the traffic.
• Host: Enter an IP address or select a host
identity.
• Port: Enter a port, port range, or select a
port identity.
• MAC: Enter a MAC address or select a MAC
address identity.
• Destination: Select defined identities or enter
individual criteria for the appropriate Host,
Port and MAC address columns to match the
destination of the traffic. See Source for the
column definitions.
• Protocols: Select protocols (such as TCP, UDP, GRE, etc) from the defined list or enter a numeric code
for other protocols to match traffic of that protocol.
• Application Sets: Select the defined application set or sets to match traffic related to those sets.
ZONE FORWARDING
Forwardings define how Filter Policies affect traffic
flowing between zones in one direction. Simply
configure the Source Zone, Destination Zone, and
Filter Policy to define a Forwarding. Forwardings can
be Added, Edited, Removed, or Toggled. Toggling a
Forwarding will either enable or disable the Forwarding.
Source and Destination zones are chosen from the list
of Zone Definitions. In addition, two special zones can
be selected for forwarding endpoints:
• The All zone will match any traffic handled by the router and is used as an endpoint for IP Filter
Rules migrated from previous firmware versions. User editable zones are preferred when adding new
forwardings.
• The Router zone will match any traffic initialized from or directed to router services and can be used
to filter router service traffic. An example of traffic initialized by a router service would be the ECM
Management service. An example of traffic destined to a router service would be the SNMP service.
OPTIONS
Firewall Options
• Anti-Spoof: Anti-Spoof checks help protect against malicious users faking the source address in packets
they transmit in order to either hide themselves or to impersonate someone else. Once the user has
spoofed their address they can launch a network attack without revealing the true source of the attack or
attempt to gain access to network services that are restricted to certain addresses.
• Log Web Access: Enable this option to create a syslog record of web (IP port 80) access. Each entry will
contain the the IP address of the server and the client. Note that this may create a lot of log entries,
especially on a busy network. Sending the system log to a syslog server is recommended.
©2016 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com
7/15/16
80