Cabletron Systems SSIM-R8-02 Spécifications télécharger pdf (Page 307)

Enterasys Xpedition User Reference Manual 287

Using ACLs

out of another interface (that is, the packet is to be routed) then a second ACL check is

possible. At the output interface, if an outbound ACL is applied, the packet will be

compared to the rules specified in this outbound ACL. Consequently, it is possible for a

packet to go through two separate checks, once at the inbound interface and once more at

the outbound interface.

When you apply an ACL to an interface, you can also specify whether the ACL can be

modified or removed from the interface by an external agent (such as the Policy Manager

application). Note that for an external agent to modify or remove an applied ACL from an

interface, the acl-policy enable external command must be in the configuration.

In general, you should try to apply ACLs at the inbound interfaces instead of the

outbound interfaces. If a packet is to be denied, you want to drop the packet as early as

possible, at the inbound interface. Otherwise, the XP will have to process the packet,

determine where the packet should go only to find out that the packet should be dropped

at the outbound interface. In some cases, however, it may not be simple or possible for the

administrator to know ahead of time that a packet should be dropped at the inbound

interface. Nonetheless, for performance reasons, whenever possible, you should create

and apply an ACL to the inbound interface.

To apply an ACL to an interface, enter the following command in Configure mode:

Applying ACLs to Services

ACLs can also be created to permit or deny access to system services provided by the XP;

for example, HTTP or Telnet servers. This type of ACL is known as a Service ACL. By

definition, a Service ACL is for controlling inbound packets to a service on specific

interfaces on the router. For example, on a particular interface, you can grant Telnet server

access from a few specific hosts or deny Web server access from a particular subnet. It is

true that you can do the same thing with ordinary ACLs and apply them to specific

interfaces. However, the Service ACL is created specifically to control access to some of

the services on specified interfaces of the XP. As a result, only inbound traffic to the XP is

checked.

Note: If a service does not have an ACL applied, that service is accessible to everyone.

To control access to a service, an ACL must be used.

To apply an ACL to a service, enter the following command in Configure mode:

Apply ACL to an interface.

acl <name> apply interface <interface name>

input|output [logging on|off|deny-only|permit-

only][policy local|external]

Apply ACL to a service. acl <name> apply service <service name> [logging

[on|off]]

1 2 ... 302 303 304 305 306 307 308 309 310 311 312 ... 393 394

Pas de commentaire

Cabletron Systems SSIM-R8-02 Spécifications Page 307