Working with Administrator-defined Interface-based Exception Filters

You can add specific policy rules at the interface level in addition to the built-in rules. Such rules give you the capability of restricting access to a port, for specific reasons, such as a Denial of Service (DoS) attack.

The policy rules are set up in the same manner as policy rules defined for a Role — specify an IP address, select a protocol if applicable, and then either allow or deny traffic to that address. For more information, see Policy Rules.

The rules defined for port exception filters are prepended to the normal set of restrictive exception filters and have precedence over the system's normal protection enforcement (that is, they are evaluated first).

Warning

If defined improperly, user exception rules may seriously compromise the system‘s normal security enforcement rules. They may also disrupt the system's normal operation and even prevent system functionality altogether. It is advised to only augment the exception-filtering mechanism if absolutely necessary.

To Define Interface Exception Filters:

1. From the top menu, click Controller.
2. In the left pane, click Network > Topologies. The Topologies screen displays.
3. Select a topology to be configured. The Edit Topology window is displayed.
4. If the topology has an L3 interface defined, an Exception Filters tab is available. Select this tab. The Exception Filter rules are displayed.
   

   
5. Add rules by either:
   • Clicking the Add Predefined button, selecting a filter from the drop down list, and clicking Add.
     

     
   • Clicking the Add button, filling in the following fields, then clicking OK:

     In the IP / subnet:port box, type the destination IP address. You can also specify an IP range, a port designation, or a port range on that IP address.

     In the Protocol drop-down list, click the protocol you want to specify for the filter. This list may include UDP, TCP, GRE, IPsec-ESP, IPsec-AH, ICMP (Internet Control Message Protocol). The default is N/A.

6. The new filter is displayed in the upper section of the screen.
7. Click the new filter entry.
8. To allow traffic, select the Allow checkbox.
9. To adjust the order of the policy rules, click Up or Down to position the rule. The policy rules are executed in the order defined here.
10. To save your changes, click Save.