Table of Contents
Advertisement
Security Configuration Procedures
•
•
•
•
•
•
•
Configuring Management Access Filters
Creating and implementing management access filters is optional. Management access filters are
software-based filters that control all traffic going in to the , including all routing protocols. They
apply to packets from all ports. The filters can be used to restrict management of the router by
other nodes outside either specific (sub)networks or through designated ports. By default, there are
no filters associated with security options. The management access filter and entries must be
explicitly created on each router. These filters also apply to the management Ethernet port.
The OS implementation exits the filter when the first match is found and execute the actions
according to the specified action. For this reason, entries must be sequenced correctly from most
to least explicit. When both mac-filter and ip-filter/ipv6-filter are to be applied to a given traffic,
mac-filter is applied first.
An entry may not have any match criteria defined (in which case, everything matches) but must
have at least an action keyword specified to be considered active . Entries without the action
keyword are considered incomplete and will be rendered inactive. Management Access Filter
must have at least one active entry defined for the filter to be active.
The following is an example of a management access filter configuration that accepts packets
matching the criteria specified in IP, IPv6 and MAC entries. Non-matching packets are denied for
IPv4 filter and permitted for IPv6 and MAC filters.
*A:Dut-C>config>system>security>mgmt-access-filter# info
----------------------------------------------
7950 SR OS System Management Guide
Configuring Management Access Filters on page 65
Configuring CPM Filters Policy on page 67
Configuring Password Management Parameters on page 68
Configuring Profiles on page 71
Configuring Users on page 72
Copying and Overwriting Users and Profiles on page 74
Enabling SSH on page 86
ip-filter
default-action deny
entry 10
description "Accept SSH from mgmnt subnet"
src-ip 192.168.5.0/26
protocol tcp
dst-port 22 65535
action permit
Security
Page 65
Advertisement
Table of Contents
