Security Authentication Before Route Information Exchange - 3Com 3C13636 Configuration Manual

3Com Router 3000 Ethernet Family
Configuration Guide
carried by the IP layer, source and destination addresses of the packet, and source and
destination ports. Then, it compares them with the preset rules to determine whether
the packet should be forwarded or discarded.
Figure 1-2 illustrates the elements selected by a packet filter for decision making (on IP
packets), given the upper layer carried by IP is TCP/UDP.
Source/Destination Source/Destination
IP addresses IP addresses
IP header IP header
Packet filtering element s Packet filtering element s
Figure 1-2 Packet filtering elements
Most packet filter systems do not make any operations on data itself or make
contents-based filtering.
II. ACL
Before the system can filter the packets, you should configure some rules in ACLs to
specify the types of packets allowed or denied.
A user should configure an ACL according to the security policy and apply it to a
particular interface or the whole equipment. After that, the router will examine all the
packets on the interface or all the interfaces based on the ACL and make
forwarding/discard decision on the packets matching the rules. In this way, it plays the
role of a firewall.
The ACL for packet filtering and the complicated traffic classification rules for QoS are
processed together. The fundamentals and operations of them are the same except of
the actions taken after the matching.
1.5 Security Authentication before Route Information
Exchange
As far as a backbone router is concerned, a correctly maintained forwarding table is
essential to the proper operation of the router. The maintenance of route forwarding
table depends on the dynamic route information exchanging between neighboring
routers.
I. Necessity of implementing security authentication before route information
exchange
As the neighboring routers on a network need to exchange enormous route information,
there is the likelihood for a router to receive the network equipment attacking
Source/Destination Source/Destination
Ports Ports
TCP/UDP TCP/UDP
Application layer header Application layer header
header header
3Com Corporation
1-5
Chapter 1 Network Security Configuration
Application layer traffic Application layer traffic
Data Data