X5368r-P3
User’s Manual Version 1.0
41
Security Policy Configuration
Scroll down and click on the
Security Policy Configuration
link
under the
Policies, Triggers and Intrusion Detection
section.
You will then see the following screen.
To configure port filters, click on the
Port Filters
link for the
specified interface. The following port filters may be added:
Field Name
Description
TCP Filter
Requires port range (start/end IP) and direction
(inbound/outbound)
UDP Filter
Requires port range (start/end IP) and direction
(inbound/outbound)
Raw IP Filter
Requires protocol type (TCP/UDP) and direction
(inbound/outbound)
To configure host validators, click on the
Host Validators
link
for the specified interface. The following host validators may
be added:
Field Name
Description
Host IP address
IP address of the host, for example 1.1.1.1
Host Subnet mask Subnet mask of the above host, for example
255.255.255.255
Direction
Select Inbound, Outbound, or Both
X5368r-P3
User’s Manual Version 1.0
42
Security Trigger Configuration
Return to the Interface List and click on the
Security Trigger
Configuration
link. A trigger is the term used to describe what
happens when a secondary port is opened dynamically to allow
protocols such as FTP and NetMeeting to pass data through the
Firewall.
Click on
New Trigger
to add a new security trigger.
The following fields are required to add a security trigger.
Field Name
Description
Transport type
Choose between TCP or UDP
Port number start
Enter the starting port number, for example 21
for FTP
Port number end
Enter the ending port number, for example 21
for FTP
Allow multiple hosts Choose between allow or block
Max Activity Interval Enter the activity interval per second.
Enable Session
Chaining
Choose between allow or block
Enable UDP
Session Chaining
Choose between allow or block
Binary Address
Replacement
Choose between allow or block
Address Translation
Type
Choose between TCP, UDP, both, or none.
Configure Intrusion Detection
Return to the Interface List and click on the
Configure Intrusion
Detection
link. On this page you will be able to select whether
you would like to use a black list and victim protection. You can
also set values for DoS attack block duration, scan attack block
duration, Victim protection block duration, maximum TCP open
handshaking count, maximum ping count, and maximum ICMP
count.
