Radware Alteon Application Manual page 393

To configure TCP flag filters
This procedure is based on
1. Configure an allow filter for TCP traffic from the LAN that allows the Web servers to pass SMTP
requests to the Internet.
>> # /cfg/slb/filt 10
>> Filter 10# sip 203.122.186.0
>> Filter 10# smask 255.255.255.0
>> Filter 10# sport any
>> Filter 10# proto tcp
>> Filter 10# dip any
>> Filter 10# dport smtp
>> Filter 10# action allow
>> Filter 10# ena
2. Configure a filter that allows SMTP traffic from the Internet to pass through Alteon only if the
destination is one of the Web servers, and the frame is an acknowledgment (SYN-ACK) of a TCP
session.
>> Filter 10# /cfg/slb/filt 15
>> Filter 15# sip any
>> Filter 15# sport smtp
>> Filter 15# proto tcp
>> Filter 15# dip 203.122.186.0
>> Filter 15# dmask 255.255.255.0
>> Filter 15# dport any
>> Filter 15# action allow
>> Filter 15# ena
>> Filter 15# adv/tcp
>> Filter 15 Advanced# ack ena
>> Filter 15 Advanced# syn ena
3. Configure a filter that allows SMTP traffic from the Internet to pass through Alteon only if the
destination is one of the Web servers, and the frame is an acknowledgment (ACK-PSH) of a TCP
session.
>> Filter 15# /cfg/slb/filt 16
>> Filter 16# sip any
>> Filter 16# sport smtp
>> Filter 16# proto tcp
>> Filter 16# dip 203.122.186.0
Document ID: RDWR-ALOS-V2900_AG1302
Alteon Application Switch Operating System Application Guide
Figure 63 - TCP Flag Filter Configuration Example, page
Filtering and Traffic Manipulation
(Select a filter for trusted SMTP requests)
(From the Web servers' source IP
address)
(For the entire subnet range)
(From any source port)
(For TCP traffic)
(To any destination IP address)
(To well-known destination SMTP port)
(Allow matching traffic to pass)
(Enable the filter)
(Select a filter for Internet SMTP ACKs)
(From any source IP address)
(From well-known source SMTP port)
(For TCP traffic)
(To the Web servers' IP address)
(To the entire subnet range)
(To any destination port)
(Allow matching traffic to pass)
(Enable the filter)
(Select the advanced TCP menu)
(Match acknowledgments only)
(Match acknowledgments only)
(Select a filter for Internet SMTP ACKs)
(From any source IP address)
(From well-known source SMTP port)
(For TCP traffic)
(To the Web servers' IP address)
392.
393