Rule Name; Direction; Action; Protocol Or Other - Cisco VPN 3000 User Manual

13
Policy Management

Rule Name

Enter a unique name for this rule. Maximum is 48 characters.

Direction

Click the drop-down menu button and select the data direction to which this rule applies:
Inbound
host. (This is the default selection.)
Outbound
host.

Action

Click the drop-down menu button and select the action to take if the data traffic (packet) matches all
parameters that follow. The choices are:
Drop
Forward
Drop and Log
Configuration | System | Events
Forward and Log
event class). See note below.
Apply IPSec
to parameters that are specified in a Security Association. You must configure a Security
Association if you select this action. Also, you can assign an SA to this rule only if you select this
(or the following) action; see Configuration | Policy Management | Traffic Management | Security
Associations
Apply IPSec and Log
class). See notes below.
Notes: The Log actions are intended for use only while debugging filter activity. Since they generate and log an
event for every matched packet, they consume significant system resources and may seriously degrade
performance.
The Apply IPSec actions are for LAN-to-LAN traffic only, not for remote-access traffic. Remote-access
IPSec traffic is authenticated and encrypted according to the SAs negotiated with the remote client
(tunnel group) and user. In LAN-to-LAN connections, individual hosts on the LANs do not negotiate
SAs. The VPN Concentrator automatically creates and applies appropriate rules when you create a
LAN-to-LAN connection; see Configuration | System | Tunneling Protocols | IPSec LAN-to-LAN .

Protocol or Other

This parameter refers to the IANA (Internet Assigned Numbers Authority)-assigned protocol number in
an IP packet. The descriptions below include the IANA number [in brackets] for reference.
13-14
= Into the VPN Concentrator interface; or into the VPN tunnel from the remote client or
= Out of the VPN Concentrator interface; or out of the VPN tunnel to the remote client or
= Discard the packet (the default selection).
= Allow the packet to pass.
= Discard the packet and log a filter debugging event ( FILTERDBG event class). See
and see note below.
= Allow the packet to pass and log a filter debugging event ( FILTERDBG
= Apply IPSec to the packet; i.e. apply packet authentication, encryption, etc. according
. See note below.
= Apply IPSec to the packet and log a filter debugging event ( FILTERDBG event
VPN 3000 Concentrator Series User Guide