Understanding How Firewall Filters Control Packet Flows - Dell PowerConnect J-EX4200-24T Software Manual

Related
Documentation

Understanding How Firewall Filters Control Packet Flows

For a multicast packet that results in replications, an egress firewall filter is applied to
each copy of the packet based on its corresponding egress VLAN.
For Layer 2 (bridged) unicast packets, the following firewall filter processing points apply:
Ingress port firewall filter
Ingress VLAN firewall filter
Egress port firewall filter
Egress VLAN firewall filter
For Layer 3 (routed and multilayer-switched) unicast packets, the following firewall filter
processing points apply:
Ingress port firewall filter
Ingress VLAN firewall filter (Layer 2 CoS)
Ingress router firewall filter (Layer 3 CoS)
Egress router firewall filter
Egress VLAN firewall filter
Firewall Filters for J-EX Series Switches Overview on page 2721
Understanding How Firewall Filters Control Packet Flows on page 2727
Understanding Bridging and VLANs on J-EX Series Switches on page 1041
Example: Configuring Firewall Filters for Port, VLAN, and Router Traffic on J-EX Series
Switches on page 2755
J-EX Series Switches support firewall filters that allow you to control flows of data packets
and local packets. Data packets are chunks of data that transit the switch as they are
forwarded from a source to a destination. Local packets are chunks of data that are
destined for or sent by the switch. Local packets usually contain routing protocol data,
data for IP services such as Telnet or SSH, and data for administrative protocols such as
the Internet Control Message Protocol (ICMP).
You create firewall filters to protect your switch from excessive traffic transiting the
switch to a network destination or destined for the Routing Engine on the switch. Firewall
filters that control local packets can also protect your switch from external incidents
such as denial-of-service (DoS) attacks.
Firewall filters affect packet flows entering in to or exiting from the switch's interfaces:
Ingress firewall filters affect the flow of data packets that are received by the switch's
interfaces. The Packet Forwarding Engine (PFE) handles this flow. When a switch
receives a data packet on an interface, the switch determines where to forward the
packet by looking in the forwarding table for the best route (Layer 2 switching, Layer 3
Chapter 100: Firewall Filters—Overview
2727