Command And Hardware Compatibility; Aspf Configuration Task List; Configuring An Aspf Policy - HP MSR Series Configuration Manual

Command and hardware compatibility

Commands and descriptions for centralized devices apply to the following routers:
•
MSR1002-4/1003-8S.
•
MSR2003.
•
MSR2004-24/2004-48.
•
MSR3012/3024/3044/3064.
•
MSR954(JH296A/JH297A/JH299A)
Commands and descriptions for distributed devices apply to MSR4060 and MSR4080 routers.

ASPF configuration task list

Tasks at a glance
(Required.)
(Required.) Applying an ASPF policy:
•
Applying an ASPF policy to an interface
•
Applying an ASPF policy to a zone pair

Configuring an ASPF policy

Follow these guidelines when you configure an ASPF policy:
•
For a multichannel protocol, if you enable TCP or UDP inspection without configuring
application layer protocol inspection, the device might not be able to receive return packets.
Hewlett Packard Enterprise recommends that you enable application layer protocol inspection
together with TCP/UDP inspection.
•
For a single-channel protocol, such as Telnet, you only need to configure the transport layer
protocol (TCP or UDP) inspection.
To configure an ASPF policy:
Step
1. Enter system view.
2. Create an ASPF policy and
enter its view.
3. (Optional.) Configure ASPF
inspection for application
layer or transport layer
protocols.
4. (Optional.) Enable ICMP
error message check.
Configuring an ASPF policy
Remarks
N/A
Perform a task according to your network
requirements.
Command
system-view
aspf-policy aspf-policy-number
detect { dccp | dns | ftp | gtp |
h323 | http | icmp | icmpv6 | ils |
mgcp | nbt | pptp | rawip | rsh |
rtsp | sccp | sctp | sip | smtp |
sqlnet | tcp | tftp | udp | udp-lite |
xdmcp }
icmp-error drop
442
Remarks
N/A
By default, no ASPF policy exists.
By default, ASPF inspection is not
configured.
By default, the ICMP error
message check is disabled. ASPF
does not drop faked ICMP error
messages.