Configuring Acl - H3C SecPath F1800-A Operation Manual

Operation Manual - VPN
H3C SecPath F1800-A Firewall
Setting the time interval for sending NAT update packets

3.2.1 Configuring ACL

I. ACL Functions
Whether an IP packet should be forwarded after IPSec process or be forwarded
directly depends on whether it matches ACL or not. Data streams to be protected are
defined based on extended IP ACL.
In general, data streams need to be authenticated for the sake of security assurance.
When high security is required, data streams should not only be authenticated but
also be encrypted. However, we know that an IPSec policy can provide a security
protection method only. Therefore, various ACLs and IPSec policies should be
defined for different data streams.
II. Creating Encryption ACL
Do as follows in system view (acl command) and the ACL view (rule command).
Table 3-1 Creating encryption ACL
Create an advanced ACL in
system view.
Define ACL rules in ACL view.
Based on ACL, IPSec protects packets that match permit statement and packets that
match deny statement will not be protected. It is recommended to set ACLs
accurately. Configure the key word permit only to data that needs to be protected and
do not use the key word any at will.
ACLs defined on the local router and the remote router should correspond to each
other, that is, mirror. Thus, the authenticated and encrypted data on one end can be
authenticated and decrypted on the peer end. If a data stream defined by local ACL
mirror is not encrypted, the local router will regard it as an attack packet and drop it.
The data stream defined by local ACL mirror is the data stream defined by peer ACL,
which forms a mirror relationship. For example:
Action
7-46
Chapter 3 IPSec Configuration
Command
acl [ number ] acl-number
rule [ rule-id ] { permit | deny } protocol
[ source source-address source-wildcard |
any ] [ destination
destination-mask | any ] [ source-port operator
port1 [ port2 ] ] [ destination-port operator
port1 [ port2 ] ] [ icmp-type icmp-type
icmp-code ] [ precedence precedence ] [ tos
tos ] [ time-range time-name ]
undo rule rule-id [ source ] [ destination ]
[ source-port ]
[ icmp-type ] [ precedence ] [ tos ]
[ time-range ]
destination-address
[ destination-port ]