HP VSR1000 Security Configuration Manual page 302

Figure 84 Network diagram
Configuration procedure
# Configure ACL 31 1 1 to deny all IP packets.
<RouterA> system-view
[RouterA] acl number 3111
[RouterA-acl-adv-3111] rule deny ip
[RouterA-acl-adv-3111] quit
# Create ASPF policy 1 for FTP inspection.
[RouterA] aspf-policy 1
[RouterA-aspf-policy-1] detect ftp
[RouterA-aspf-policy-1] quit
# Apply ACL 31 1 1 to deny all incoming IP packets on interface GigabitEthernet 1/0.
[RouterA] interface GigabitEthernet 1/0
[RouterA-GigabitEthernet1/0] packet-filter 3111 inbound
# Apply ASPF policy 1 to the outbound direction of interface GigabitEthernet 1/0.
[RouterA-GigabitEthernet1/0] aspf apply policy 1 outbound
Verifying the configuration
# Display ASPF sessions on Router A.
<RouterA> display aspf session ipv4
Initiator:
Source
Destination IP/port: 2.2.2.11/21
VLAN ID/VLL ID: -/-
Protocol: TCP(6)
Total sessions found: 1
The output shows that an ASPF session has been established for the FTP connection between the host and
the FTP server.
# Verify that only the return packets of FTP connections can enter the internal network. (Details not
shown.)
IP/port: 192.168.1.2/1877
292