Individual Rule Screen

This screen allows you to configure each rule in the filter set. You are allowed to create up to 12 filter sets and up to 6 rules for each filter set.

Click on the fields in the image below to go to the corresponding description.

a19.GIF (5336 bytes)

Description

The PNC provides a list of predefined filter types in the Rule Type pull-down list to help you in creating your own filter rules. With these types, you will be able to base your rules on applications (WWW, FTP, DNS, SMTP mail, etc.), sites (IP addresses), or TCP/UDP ports. Or you can create specialized rules based on other criteria with the custom types, as explained in Custom TCP/IP and Custom Generic Types below.

Custom TCP/IP and Custom Generic Types

Select the Custom TCP/IP or the Custom Generic rule type to create your specialized rules.

The More switch is common in both screens. If this switch is off, a packet matching the rule is immediately dropped or forwarded, depending on whether you choose Restrict or Allow in the Filter Action field. However, if the switch is yes, the Filter Action field will be dimmed and a matching packet is passed to the next rule. This mechanism allows you to chain multiple rules together to create a compound rule. A matching packet will have to go through the chain of rules before an action is taken.

  1. Custom TCP/IP
  2. The Custom TCP/IP type allows you to base a rule on the fields in the IP or upper layer, e.g., UDP and TCP, headers. Rules of this type are used to create Protocol type filter sets.

    The Protocol box contains the upper layer protocol number, e.g., TCP is 6, UDP is 17 and ICMP is 1. If the Source Route switch is set to no, a packet must not contain source routes (an IP option) to match the rule. The Address, Subnet Mask and Port Number fields are for you to enter the respective value for either the source or the destination of the packet. The Port # Compare list allows you choose the comparison to apply to the port number in the packet to that in the filter rule, e.g., if you choose Greater Than and the Port Number is 1023, then all packets with port number 1024 and above will match the rule.

    The TCP Established switch is applicable only when the Protocol is 6, i.e. TCP. If it is yes, then the rule applies only after the TCP connection has been established. Otherwise, the rule applies to all TCP packets.

  3. Custom Generic

The Custom Generic type is used to create Device type filter sets. This rule type treats the packet as a byte stream. There are four parameters, namely Offset, Length, Mask and Value that you must enter. The portion of the data to compare is specified with the offset (starting from 0) and the length (both in bytes). The Prestige applies (logically ANDing) the mask to the data before comparing it to the value.

  • Active: This activates/deactivates this rule.
  • Filter Action: This determines what to do with a packet matching this rule. The choices are:
    • Drop: Restrict drops a matching packet, while Allow tells the Prestige to forward the packet if there are no more rules in the set.
    • Next Rule: If there are more rules, then the packet will be passed along to the next rule. A packet that does not match the rule is always passed to the next rule.
  • Log Filter Rule: You can use the filter logging facility to help to debug your filters. The choices are:
    • None: Does not generate any log entry.
    • Packet Matched: Generates a log entry only when a packet matches the rule.
    • Packet Not Matched: Generates log entries for packets not matching this rule.
    • Both: Generates log entries for both matched and unmatched packets.

The log is sent to a logging server using UNIX syslog facility. Please note that the Both choices in effect generate a log entry per rule for every packet passing through a port. It could easily overwhelm the Prestige and should be avoided if possible.


 

zylogo1.gif (2311 bytes)

ZyXEL Communications Corporation