Comware

 View Only
Back to discussions
Expand all | Collapse all

MSR20-40 ACL for a global servers

This thread has been viewed 0 times

  • 1.  MSR20-40 ACL for a global servers

    Posted Mar 15, 2011 04:50 PM

    Hi!

     

    I have a MSR20-40, but i dont understend how can configure acl for global servers

     

    acl number 3002

     rule 11 permit tcp established source xxx.xxx.xxx.xxx 0 destination xxx.xxx.xxx.xxx 0 destination-port eq 22 logging
     rule 12 permit tcp established source xxx.xxx.xxx.xxx 0 destination 192.168.15.200 0 destination-port eq 1521 logging

    rule 16 deny tcp established destination xxx.xxx.xxx.xxx 0 destination-port eq 22 logging
     rule 17 deny tcp established destination xxx.xxx.xxx.xxx 0 destination-port eq www logging
     rule 18 deny tcp established destination xxx.xxx.xxx.xxx 0 destination-port eq 3389 logging

     rule 19 deny tcp established destination 192.168.15.200 0 destination-port eq 1521 logging

     

    interface Ethernet0/0
     port link-mode route
     firewall packet-filter 3002 inbound
     nat outbound 3001
     nat server 1 protocol tcp global current-interface 1521 inside 192.168.15.200 1521
     nat server 2 protocol tcp global current-interface 3389 inside 192.168.15.200 3389
     undo dhcp select server global-pool
     ip address dhcp-alloc
     dar enable
     qos apply policy PolicyLimitOut outbound
     ipsec no-nat-process enable
     ipsec policy 983040
     ip flow-ordering external

     

     

    acl 3002 not work, what i do wrong?

     

    Thanks for answer

     



  • 2.  RE: MSR20-40 ACL for a global servers

    Posted Mar 16, 2011 07:58 AM

    i solve this problem myself

     

    rule 0 permit tcp source xx.xxx.xxx.xx 0 destination-port eq 3389 logging
    rule 1 permit tcp source xxx.xx.xx.xx 0 destination-port eq 3389 logging
    rule 5 deny tcp destination-port eq 3389 logging

    rule 10 permit tcp source xx.xxx.xxx.xx 0 destination-port eq 1521 logging
    rule 11 permit tcp source 192.168.15.0 0.0.0.255 destination-port eq 1521 logging
    rule 12 permit tcp source 192.168.0.0 0.0.0.255 destination-port eq 1521 logging
    rule 15 deny tcp destination-port eq 1521 logging

     

    im buy this device for home, but manual i not understand

    i return my cisco 1841 - this is a best device