Huawei S9700 Series Configuration Manual page 40

S9700 Core Routing Switch
Configuration Guide - SPU
The SPU considers that the data transmission within a zone is reliable; therefore, it does not
enforce any security policy on the intra-zone data transmission. The SPU verifies the data and
enforces the security policies only when the data flows from one zone to another.
Interzone
Any two zones form an interzone. Each interzone has an independent interzone view. Most
firewall configurations are performed in the interzone views.
Assume that there are zone1 and zone2. In the interzone view, ACL-based packet filtering can
be configured. The configured filtering policy is then enforced on the data transmission between
zone1 and zone2.
Direction
In an interzone, data is transmitted in the inbound or outbound direction.
l
l
ACL-based Packet Filtering
ACL-based packet filtering analyzes the information in the packets to be forwarded, including
source/destination IP addresses, source/destination port numbers, and IP protocol number. The
SPU compares the packet information with the ACL rules and determines whether to forward
or discard the packets.
In addition, the SPU can filter fragmented IP packets to prevent a non-initial fragment attack.
ASPF
ASPF is applied to the application layer, that is, ASPF is status-based packet filtering. ASPF
detects the application-layer sessions that attempt to pass the firewall, and discards undesired
packets.
The SPU performs ASPF for the File Transfer Protocol (FTP) and Hypertext Transport Protocol
(HTTP) packets.
Blacklist
A blacklist filters packets based on source IP addresses. Compared with the ACL, the blacklist
uses simpler matching fields to implement high-speed packet filtering. Packets from certain IP
addresses can be filtered out.
The firewall dynamically adds IP addresses to the blacklist. The firewall uses packet behavior
to detect an attack from an IP address. If an attack is detected, the firewall adds the IP address
of the attacker to the blacklist so that all packets from the attacker will be discarded.
Whitelist
The whitelist prevents specified IP addresses from being added to the blacklist. The IP addresses
in the whitelist will not be added to the static or dynamic blacklist. An entry in the whitelist is
represented by the source VPN and IP address.
Issue 01 (2012-03-15)
Inbound: indicates that data flows from a zone with lower priority to a zone with higher
priority.
Outbound: indicates that data flows from a zone with higher priority to a zone with lower
priority.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
2 Firewall Configuration
29