Applying An Aspf Policy To An Interface; Applying An Aspf Policy To A Zone Pair - HP MSR Series Configuration Manual

Step
5. (Optional.) Enable TCP SYN
check.

Applying an ASPF policy to an interface

You can apply an ASPF policy to inspect incoming or outgoing traffic on an interface. ASPF
compares the packets against session entries. If a packet does not match any session entries, ASPF
creates a new session entry.
You can apply both ASPF and packet filter to implement packet filtering. For example, you can apply
a packet filtering policy to the inbound direction of the external interface and apply an ASPF policy to
the outbound direction of the external interface. The application denies unsolicited access from the
external network to the internal network and allows return packets from external to the internal
network.
Check that a connection initiation packet and the corresponding return packet pass through the
same interface, because an ASPF stores and maintains the application layer protocol status based
on interfaces.
To apply an ASPF policy on an interface:
Step
1. Enter system view.
2. Enter interface view.
3. Apply an ASPF policy to the
interface.

Applying an ASPF policy to a zone pair

The following matrix shows the feature and hardware compatibility:
Hardware
MSR954(JH296A/JH297A/JH299A)
MSR1002-4/1003-8S
MSR2003
MSR2004-24/2004-48
MSR3012/3024/3044/3064
MSR4060/4080
You can apply an ASPF policy to a zone pair to inspect traffic from the source zone to the destination
zone. ASPF compares all packets with session entries. If a packet that is permitted by packet filtering
does not match any existing session entries, ASPF creates a new session entry.
ASPF for a zone pair takes effect only when it functions with a packet filter:
Command
tcp syn-check
Command
system-view
interface interface-type
interface-number
aspf apply policy
aspf-policy-number { inbound |
outbound }
Feature compatibility
No
Yes
Yes
Yes
Yes
Yes
443
Remarks
By default, TCP SYN check is
disabled. ASPF does not drop the
non-SYN packet when it is the first
packet to establish a TCP
connection.
Remarks
N/A
N/A
By default, no ASPF policy is
applied to the interface.