Motorola 2241N-VGX Guide de l'utilisateur télécharger pdf (Page 169)

169

Firewall Tutorial

Filter priority

Continuing the customs inspectors analogy, imagine the

inspectors lined up to examine a package. If the package

matches the ﬁrst inspector’s criteria, the package is either

rejected or passed on to its destination, depending on the

ﬁrst inspector’s particular orders. In this case, the package

is never seen by the remaining inspectors.

If the package does not match the ﬁrst inspector’s criteria,

it goes to the second inspector, and so on. You can see that

the order of the inspectors in the line is very important.

For example, let’s say the ﬁrst inspector’s orders are to

send along all packages that come from Rome, and the sec-

ond inspector’s orders are to reject all packages that come

from France. If a package arrives from Rome, the ﬁrst

inspector sends it along without allowing the second inspec-

tor to see it. A package from Paris is ignored by the ﬁrst

inspector, rejected by the second inspector, and never seen

by the others. A package from London is ignored by the ﬁrst

two inspectors, so it’s seen by the third inspector.

In the same way, ﬁlter sets apply their ﬁlters in a particular

order. The ﬁrst ﬁlter applied can forward or discard a packet

before that packet ever reaches any of the other ﬁlters. If the ﬁrst ﬁlter can neither forward

nor discard the packet (because it cannot match any criteria), the second ﬁlter has a

chance to forward or reject it, and so on. Because of this hierarchical structure, each ﬁlter

is said to have a priority. The ﬁrst ﬁlter has the highest priority, and the last ﬁlter has the

lowest priority.

How individual ﬁlters work

As described above, a ﬁlter applies criteria to an IP packet and then takes one of three

actions:

•

Forwards the packet to the local or remote network

•

Blocks (discards) the packet

•

Ignores the packet

A ﬁlter forwards or blocks a packet only if it ﬁnds a match after applying its criteria. When

no match occurs, the ﬁlter ignores the packet.

packet

first

filter

match?

yes

forward

discard?

to network

discard

(delete)

forward

to next

filter

send

1 2 ... 164 165 166 167 168 169 170 171 172 173 174 ... 368 369

Commentaires sur ces manuels

Pas de commentaire

Motorola 2241N-VGX Guide de l'utilisateur Page 169

Commentaires sur ces manuels

Produits connexes et manuels pour Mise en réseau Motorola 2241N-VGX