Radware Alteon Application Manual page 380

Alteon Application Switch Operating System Application Guide
Filtering and Traffic Manipulation
• Filtering is not limited to the few protocols and TCP or UDP applications shown in this example.
See Well-Known Application Ports, page 175
1. Before you begin, you must be logged into the CLI as the administrator.
2. Assign an IP address to each of the network devices.
For this example, the network devices have the following IP addresses on the same IP subnet:
Table 31: Web Cache Example Real Server IP Addresses
Network Device
Local Subnet
Web Server
Mail Server
Domain Name Server
3. Create a default filter to deny and log unwanted traffic.
The default filter is defined as Filter 2048 in order to give it the lowest order of precedence:
>> # /cfg/slb/filt 2048
>> Filter 2048# sip any
>> Filter 2048# dip any
>> Filter 2048# proto any
>> Filter 2048# action deny
>> Filter 2048# name deny unwanted traffic
>> Filter 2048# ena
>> Filter 2048# adv/log enable
Note: Because the proto parameter is not tcp or udp, the source port (sport) and destination
port (dport) values are ignored and may be excluded from the filter configuration.
4. Create a filter that allows external HTTP requests to reach the Web server.
The filter must recognize and allow TCP traffic with the Web server's destination IP address and
HTTP destination port:
>> Filter 2048# /cfg/slb/filt 1
>> Filter 1# sip any
>> Filter 1# dip 205.177.15.2
>> Filter 1# dmask 255.255.255.255
>> Filter 1# proto tcp
>> Filter 1# sport any
>> Filter 1# dport http
>> Filter 1# action allow
380
for a list of well-known applications ports.
IP address
205.177.15.0 - 205.177.15.255
205.177.15.2
205.177.15.3
205.177.15.4
(Select the default filter)
(From any source IP addresses)
(To any destination IP addresses)
(For any protocols)
(Deny matching traffic)
(Provide a descriptive name for the
filter)
(Enable the default filter)
(Log matching traffic to syslog)
(Select the menu for Filter 1)
(From any source IP address)
(To Web server destination IP address)
(Set mask for exact destination address)
(For TCP protocol traffic)
(From any source port)
(To an HTTP destination port)
(Allow matching traffic to pass)
Document ID: RDWR-ALOS-V2900_AG1302