Configuring And Applying Connection-Rate Acls - HP ProCurve 6200yl Series Access Security Manual

Virus Throttling

Configuring and Applying Connection-Rate ACLs

3-20
Configuring and Applying Connection-
Rate ACLs
Command
ip access-list connection-rate-filter < crf-list-name >
< filter | ignore > ip < any | host < ip-addr > | ip-addr < mask >>
< filter | ignore > < udp | tcp > < source > < options >
vlan < vid > ip access-group < crf-list-name > connection-rate-filter
A host sending legitimate, routed traffic can trigger connection-rate filtering
in some circumstances. If you can verify that such a host is indeed sending
valid traffic and is not a threat to your network, you may want to configure a
connection-rate ACL (access control list) that allows this traffic to bypass the
configured connection-rate filtering.
A connection-rate Access Control List (ACL) is an optional tool that consists
of one or more explicitly configured Access Control Entries (ACEs) used to
specify whether to enforce the configured connection-rate policy on traffic
from a particular source.
Use of connection-rate ACLs provides the option to apply exceptions to the
configured connection-rate filtering policy. This enables you to allow legiti­
mate traffic from a trusted source, and apply connection-rate filtering only to
inbound traffic from untrusted sources. For example, where a connection-rate
policy has been configured, you can apply a connection-rate ACL that causes
the switch bypass connection-rate policy filtering on traffic from:
A trusted server exhibiting a relatively high IP connection rate due to
■
heavy demand
A trusted traffic source on the same port as other, untrusted traffic
■
sources.
The criteria for an exception can include the SA of traffic from a specific host,
group of hosts, or a subnet, and can also include source and destination TCP/
UDP criteria. This allows you to apply a notify-only, throttling, or blocking
policy while allowing exceptions for legitimate traffic from specific sources.
You can also allow exceptions for traffic with specific TCP or UDP criteria.
For more information on when to apply connection-rate ACLs, refer to "Appli­
cation Options" on page 3-6.
Page
3-22, 3-23
3-22
3-23