Connection-Rate Acl Operating Notes - HP 3500yl Series Access Security Manual

Virus Throttling (Connection-Rate Filtering)
Configuring and Applying Connection-Rate ACLs
3-28
HP Switch(config)# show config
Startup configuration
; J8697A Configuration Editor; Created on release #K.15.XX
hostname "HP Switch"
connection-rate-filter sensitivity high
ip access-list connection-rate-filter "17-server"
ignore ip 15.45.50.17
exit
module 2 type J8702A
module 4 type J8702A
ip routing
logging 13.28.234.180
snmp-server community "public" Unrestricted
snmp-server host 15.45.200.75 "public"
vlan 1
name "DEFAULT_VLAN"
untagged B5-B24
no ip address
no untagged B1-B4, D1-D24
ip proxy-arp
exit
vlan 10
name "VLAN10"
untagged B1-B4
no ip address
ip proxy-arp
exit
vlan 15
name "VLAN_15"
untagged D1-D24
no ip address
ip proxy-arp
ip access-group "17-server" connection-rate-filter
exit
filter connection-rate B4 notify-only
filter connection-rate B1-B3 throttle
filter connection-rate B9, D1-D2 block
Figure 3-12. Example of Switch Configuration Display with a Connection-Rate ACL

Connection-Rate ACL Operating Notes

■ ACE Types: A connection-rate ACL allows you to configure two types
of ACEs (Access Control Entries):
ignore < source-criteria >: This ACE type directs the switch to permit
•
all inbound traffic meeting the configured < source-criteria > without
filtering the traffic through the connection-rate policy configured on
0.0.0.0
The new switch configuration
includes the ACL configured in
figure 3-11.
Shows the assignment of the
above connection-rate ACL to
VLAN 15.