User's Manual

Table Of Contents
Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
160
Name: a unique packet filter rule name of 1 to 200
characters.
Action: whether to permit the packet or deny it. Denied
packets are dropped without further processing.
NOTE: The user
must turn on the
global Common Criteria
logging as well as set-
ting the log switch on
the individual filter rule
in order to request these
audit logs. See set
logging -ccaudit in
Section 4.7.1.
Log: whether or not to log when a packet matches this rule.
The FMP will write out audit logs reporting what packets
have matched the rule. For performance reasons, the FMP
reports the count of how many packets have matched the
rule over the last 8 seconds, rather than emitting a log for
every packet.
Type: what type of packet - IPv4, IPv6, TCP, or UDP - to
match.
Interface: this rule will be tested whenever a packet
enters or exits the FMP on this interface.
NOTE: There is no
requirement for
the priorities to be num-
bered contiguously. In
fact it is common to
leave gaps in case a new
intervening rule is
needed in the future,
because it is not possible
to modify an existing
rule. The user must
delete the rule and re-
add it with the updated
specifications.
Priority: the order in which to apply this rule. Priority is a
number between 1 and 16 inclusive. Rules on each
interface are tested against the packet beginning with the
lowest numbered priority and ending with the highest
numbered priority.
In addition, depending on the
Type chosen, you may be
required to enter other information.
For
Type IPv4 or IPv6:
REQUIRED: Source Address of the appropriate Type (e.g.,
if
Type is IPv4, the Source Address must be an IPv4
address);
REQUIRED: Source Prefix Length. This is the bit length of
the subnet mask of the IP Address (e.g., if the IPv4 mask is
255.255.255.0, the Prefix Length is 24);
REQUIRED: Destination Address of the appropriate Type,
plus Destination Prefix Length;
OPTIONAL: Protocol Number: the Internet Assigned
Numbers Authority (IANA) number of the IPv4 or IPv6
protocol on which to filter. If the protocol is not specified, the
filter is applied to all protocols of that
Type (IPv4 or IPv6).
NOT ALLOWED: Source or Destination Port.
For
Type TCP or UDP:
OPTIONAL: Source Port: the IANA number of the TCP or
UDP port to match to the source port of the packet. If the
source port is not specified, the filter will be applied no
matter what the packet's source port is.
OPTIONAL: Destination Port: the IANA number of the TCP
or UDP port to match to the destination port of the packet. If