Configuring An Aspf Policy; Applying An Aspf Policy To An Interface; Configuring Port Mapping - HP A6600 Configuration Manual

Configuring an ASPF policy

To do...
1. Enter system view.
2. Create an ASPF policy and enter
its view.
3. Specify to drop ICMP error
messages.
4. Specify to drop non-SYN packet
that is the first packet over a TCP
connection.

Applying an ASPF policy to an interface

Two concepts are distinguished in ASPF policy: internal interface and external interface. If the router is
connected to both the internal network and the Internet and employs ASPF to protect the internal servers,
the interface connected to the internal network is the internal interface, and the one connected to the
Internet is the external interface. When both ASPF and packet filtering firewall are applied to the
external interface, access to the internal network from the Internet is denied. Yet, the response packet
can pass ASPF when internal network users access the Internet.
To monitor the traffic through an interface, you must apply the configured ASPF policy to that interface.
Because it is based on interfaces that an ASPF stores and maintains the application layer protocol status,
make sure that a connection initiation packet and the corresponding return packet are based on the
same interface.
To apply an ASPF policy on an interface:
To do...
1. Enter system view.
2. Enter interface view.
3. Apply an ASPF policy to the interface.

Configuring port mapping

Two mapping mechanisms exist: general port mapping and basic ACL–based host port mapping.
A general port mapping refers to a mapping of a user-defined port number to an application layer
•
protocol. If port 8080 is mapped to HTTP, for example, all TCP packets with the destination port of
8080 are regarded as HTTP packets.
A host port mapping refers to a mapping of a user-defined port number to an application layer
•
protocol for packets to some specific hosts. For example, establish a host port mapping so that all
Command...
system-view
aspf-policy aspf-policy-number
icmp-error drop
tcp syn-check
Command...
system-view
interface interface-type interface-
number
firewall aspf aspf-policy-number
{ inbound | outbound }
353
Remarks
—
Required.
Optional.
By default, ICMP error messages
are not dropped.
Optional.
By default, a non-SYN packet that
is the first packet over a TCP
connection is not dropped.
Remarks
—
—
Required
Not applied by default