13-10 Administration GuideFiltering example #2Suppose a filter is configured to block all incoming IP packets with the source IP address of 200.233.14.0,regardless of the type of connection or its destination. The filter would look like this:This filter blocks any packets coming from a remote network with the IP network address 200.233.14.0. The 0at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filteris applied to a packet with the source IP address 200.233.14.5, it will block it.In this case, the mask, which does not appear in the table, must be set to 255.255.255.0. This way, allpackets with a source address of 200.233.14.x will be matched correctly, no matter what the final address byteis.Note: The protocol attribute for this filter is 0 by default. This tells the filter to ignore the IP protocol or type ofIP packet.Design guidelinesCareful thought must go into designing a new filter set. You should consider the following guidelines: Be sure the filter set’s overall purpose is clear from the beginning. A vague purpose can lead to a faultyset, and that can actually make your network less secure. Be sure each individual filter’s purpose is clear. Determine how filter priority will affect the set’s actions. Test the set (on paper) by determining how thefilters would respond to a number of different hypothetical packets. Consider the combined effect of the filters. If every filter in a set fails to match on a particular packet, thepacket is: Forwarded if all the filters are configured to discard (not forward) Discarded if all the filters are configured to forward Discarded if the set contains a combination of forward and discard filtersDisadvantages of filtersAlthough using filter sets can greatly enhance network security, there are disadvantages: Filters are complex. Combining them in filter sets introduces subtle interactions, increasing the likelihoodof implementation errors. Enabling a large number of filters can have a negative impact on performance. Processing of packets willtake longer if they have to go through many checkpoints. Too much reliance on packet filters can cause too little reliance on other security methods. Filter sets arenot a substitute for password protection, effective safeguarding of passwords, caller ID, the “must match”+-#---Source IP Addr---Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-++----------------------------------------------------------------------+| 1 200.233.14.0 0.0.0.0 0 Yes No || |+----------------------------------------------------------------------+
