<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0mm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Trebuchet MS","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Tahoma","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Keep in mind that Management access filters apply to both out-of-band AND in-band connections, and also include any control-plane protocols. So you’ll need to
open things like OSPF, BGP, etc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">If im not mistaken, there is a “source port” on the match parameters, so you can have a couple of entries matching src-port “cpm” (this means the OOB port on
the CPM) and then a drop-all on anything else on the CPM port. Then do matches (or an allow all) on the in-band traffic. For in-band traffic we recommend you use the cpm-filters which are based on hardware.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Please be careful when doing these kind of changes so as not to log yourself out of the box.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">In particular, you might want to use a cron-job to “disable” the MAF and CPM filters every 10 minutes in case you lock yourself out. Even if you have OOB serial
connectivity, if you’re using RADIUS or other login authentication methods with no fallback, you might not even be able to login to the box itself if you break things badly enough.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Best Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><img width="433" height="34" id="Picture_x0020_1" src="cid:image001.gif@01CE4273.70673F90" alt="nuage-alu copy"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#9D1B32">DIEGO GARCÍA DEL RIO<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">nuage</span></b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">networks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">PRODUCT MANAGEMENT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">755 Ravendale Drive<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">Mountain View CA 94043<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">Mobile: +1 (415) 439-9420<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR" style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">OnNet: 2852-2726<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="FR" style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:black">diego@nuagenetworks.net | diego.garcia_del_rio@alcatel-lucent.com<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span lang="FR" style="font-size:11.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0mm 0mm 0mm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> alcatel-nsp [mailto:alcatel-nsp-bounces@puck.nether.net]
<b>On Behalf Of </b>Coulter, John (John)<br>
<b>Sent:</b> Friday, 26 April 2013 6:03 AM<br>
<b>To:</b> Amit Dhamija; alcatel-nsp@puck.nether.net<br>
<b>Subject:</b> Re: [alcatel-nsp] ACL/Rule Set<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D">Amit,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D">To filter traffic on the mgmt port you use management access filter under:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D">configure system security management-access-filter<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D">John<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0mm 0mm 0mm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> alcatel-nsp [<a href="mailto:alcatel-nsp-bounces@puck.nether.net">mailto:alcatel-nsp-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Amit Dhamija<br>
<b>Sent:</b> Friday, April 26, 2013 7:43 AM<br>
<b>To:</b> <a href="mailto:alcatel-nsp@puck.nether.net">alcatel-nsp@puck.nether.net</a><br>
<b>Subject:</b> Re: [alcatel-nsp] ACL/Rule Set<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">I managed to get the config , Facing one issue while applying the filters under CPM to restrict SSH,Telnet access , I am able to do it for system & interfaces address . I am using out of band management if i want to
restrict for same .How to do it ??<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">In Below statement i am dropping all TCP Port 23 , but out of band management is still working..<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> ip-filter<br>
entry 20 create<br>
action drop<br>
description "Telnet-Access"<br>
match protocol tcp<br>
dst-port 23 65535<br>
src-ip <a href="http://10.54.2.0/24">10.54.2.0/24</a><br>
exit<br>
exit<br>
entry 21 create<br>
action drop<br>
description "Untrusted Telnet access"<br>
match protocol tcp<br>
dst-port 23 65535<br>
exit<br>
exit<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Thanks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><br>
<br>
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, Apr 26, 2013 at 1:24 PM, Amit Dhamija <<a href="mailto:amiitdhamija@gmail.com" target="_blank">amiitdhamija@gmail.com</a>> wrote:<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Could you please help me with config how to apply ACL's or rule set for Protcols SNMP,NTP,Telnet Server etc in ALU.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Also if i want to apply ACL on Interface /MDA Port what is the configuration for that.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Thanks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:#888888">Amit <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>