Ericsson HL950 Administrator's Manual page 74

Multi Service Edge Device HL950
Administrator's Guide
By using the MOVE parameter you can change the priority of a policy UP and/or DOWN in the table.
If HL950 receives network traffic on any of its network interface for which there is no access policy
available, it blocks that traffic. A log event indicating "No policy matched" will be generated in this
case.
For detailed information about prefixes and parameters for the SECURITY FIREWALL command,
see section 6.6.5.
4.6.1.4 Typical Firewall Examples
The policies added in the following example are a subset of the typical policies a system administrator
would add to prevent Denial of Service attacks:
Policy 1;
!
Allow incoming traffic that is destinated to IP addresses that belong to the corporate LAN.
This prevents the LAN being used as a transit for public data.
HL950> add security firewall:type=lanin, ipsn=any, psn=any,
ipds=192.168.10.0, dmask=24, pdn=any, prot=all, allow=true,
log=true, ppos=begin;
Policy 2;
!
Allow outgoing traffic that is initiated from IP addresses that belong inside the corporate
LAN. This prevents address spoofing by internal users.
HL950> add security firewall:type=lanout, ipss=192.168.10.0,
smask=24, ipdn=any, psn=any, pdn=any, prot=all, log=true,
ppos=begin, allow=true;
At this time you may remove the pre-configured policy allowing traffic from any IP address to
any IP address as it is redundant.
Policy 3;
!
Disallow traffic to or from special reserved IP address ranges. These ranges should never be
allowed across organizational domains as they are reserved by IETF. Please refer to RFC
1918.
1. 10.0.0.0 to 10.255.255.255
2. 127.0.0.0 to 127.255.255.255.255
3. 172.16.0.0 to 172.31.255.255
4. 192.168.0.0 to 192.168.255.255 (we are using these for demo purposes. The actual
IP address would never be in this range).
Add policies to deny all packets from or to these IP address ranges (except 4).
Add to LANtoWAN policies:
HL950> add security firewall:type=lanout, ipss=10.0.0.0,
ipse=10.255.255.255.255, ipdn=any, psn=any, pdn=any, prot=all,
allow=false, log=true, ppos=begin;
HL950> add security firewall:type=lanout, ipss=127.0.0.0,
ipse=127.255.255.255.255, ipdn=any, psn=any, pdn=any, prot=all,
EN/LZT 108 5995 R3
June 2003
Page 74 (159)