Cabletron Systems SSIM-R8-02 Spécifications télécharger pdf (Page 304)

Creating and Modifying ACLs

284 Enterasys Xpedition User Reference Manual

Allowing External Responses to Established TCP Connections

Typically organizations that are connected to the outside world implement ACLs to deny

access to the internal network. If an internal user wishes to connect to the outside world,

the request is sent; however any incoming replies may be denied because ACLs prevent

them from going through. To allow external responses to internally generated requests,

you would have to create an ACL to allow responses from each specific outside host. If the

number of outside hosts that internal users need to access is large or changes frequently,

this can be difficult to maintain.

To address this problem, the XP can be configured to accept outside TCP responses into

the internal network, provided that the TCP connection was initiated internally.

Otherwise, it will be rejected. To do this, enter the following command in Configure

Mode:

Note: The ports that are associated with the interface to which the ACL is applied must

reside on updated XP hardware.

The following ACL illustrates this feature:

Any incoming TCP packet on interface int1 is examined, and if the packet is in response to

an internal request, it is permitted; otherwise, it is rejected. Note that the ACL contains no

restriction for outgoing packets on interface int1, since internal hosts are allowed to access

the outside world.

Creating and Modifying ACLs

The XP provides two mechanisms for creating and modifying ACLs:

• Editing ACLs on a remote host and uploading them to the XP using TFTP or RCP

• Using the XP’s ACL Editor

The following sections describe these methods.

Allow TCP responses from external hosts,

provided the connection was established

internally.

acl <name> permit tcp established

acl 101 permit tcp established

acl 101 apply interface int1 input

1 2 ... 299 300 301 302 303 304 305 306 307 308 309 ... 393 394

Pas de commentaire

Cabletron Systems SSIM-R8-02 Spécifications Page 304