Configuring A Packet Filtering Firewall; Configuration Task List; Enabling The Firewall Function - HP A6600 Configuration Manual

As the figure shows, to protect the internal network, an ACL is usually required on the router to permit
internal hosts to access external networks while prohibiting hosts on external networks from accessing
the internal network. However, the ACL also filters out the return packets to internal users, thus failing the
connection setup attempts.
ASPF implements the application layer protocol detection function in cooperation with the session
management and ALG features. After detecting the first packet of a session, ASPF matches the packet
with the configured policy and sends the result to the session management feature, which is responsible
for session information database establishment and session status maintenance. Then, the ASPF
processes subsequent packets of the session based on session status information returned by the session
management feature.
For details about session management, see
Transport layer protocol detection
The transport layer protocol detection here refers to general TCP/UDP detection. Different from
application layer protocol detection, general TCP/UDP detection is specific to the transport layer
information in the packets, such as source and destination addresses and port number. General
TCP/UDP detection requires a full match between the packets returned to the external interface of the
ASPF and the packets previously sent out from the external interface of ASPF, namely, a perfect match of
the source and destination address and port number. Otherwise, the return packets are blocked.
Therefore, for multi-channel application layer protocols like FTP and H.323, the deployment of TCP
detection without application layer detection leads to failure to establish a data connection.

Configuring a packet filtering firewall

Configuration task list

Task

Enabling the firewall function

Configuring the firewall default filtering action
Configuring packet filtering on an interface
Enabling the firewall function
Enabling the IPv4 firewall function
To do...
1. Enter system view.
2. Enable the IPv4 firewall
function on a centralized
router.
3. Enable the IPv4 firewall
function on a distributed
router.
"Configuring session
Remarks
Required
Optional
Required
Command...
system-view
firewall enable
firewall enable { all | slot slot-
number }
348
management" and "Configuring
Remarks
—
Required
Disabled by default
Required
Disabled by default
ALG."