ProCurve 6200yl User's Guide download pdf (Page 90)

100

101

3-30

Virus Throttling

Configuring and Applying Connection-Rate ACLs

• filter < source-criteria >: This ACE type does the opposite of an ignore

entry. That is, all inbound traffic meeting the configured < source-

criteria > must be filtered through the connection-rate policy config-

ured for the port on which the traffic entered the switch. This option

is most useful in applications where it is easier to use filter to specify

suspicious traffic sources for screening than to use ignore to specify

exceptions for trusted traffic sources that don’t need screening. For

example, if the host at 15.45.127.43 requires connection-rate screen-

ing, but all other hosts in the VLAN do not, you would configure and

apply a connection-rate ACL with filter ip host 15.45.127.43 as the first

ACE and ignore ip any as the second ACE. In this case, the traffic from

host 15.45.127.43 would be screened, but traffic from all other hosts

on the VLAN would be permitted without connection-rate screening.

■ Implicit ACE: A connection-rate ACL includes a third, implicit filter

ip any ACE which is automatically the last ACE in the ACL. This

implicit ACE does not appear in displays of the ACL configuration,

but is always present in any connection-rate ACL you configure. For

example, assume that a port is configured with a connection-rate

policy and is in a VLAN configured with a connection-rate ACL. If

there is no match between an incoming packet and the ACE criteria

in the ACL, then the implicit filter ip any sends the packet for screening

by the connection-rate policy configured on that port. To preempt the

implicit filter ip any in a given connection-rate ACL, you can configure

ignore IP any as the last explicit ACE in the connection-rate ACL. The

switch will then ignore (permit) traffic that is not explicitly addressed

by other ACEs configured sequentially earlier in the ACL without

filtering the traffic through the existing connection-rate policy.

■ Monitoring Shared Resources: Active instances of throttling or

blocking a client that is generating a high rate of connection requests

uses internal routing switch resources that are shared with several

other features. The routing switch provides ample resources for all

features. However, if the internal resources become fully subscribed,

new instances of throttling or blocking cannot be initiated until the

necessary resources are released from other uses. (Event Log

messages and SNMP traps are not affected.) For information on

determining current resource availability and usage, refer to the

appendix titled “Monitoring Resources” in the Management and

Configuration Guide for your switch.

1 2 ... 85 86 87 88 89 90 91 92 93 94 95 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 90

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl