H3C Technologies H3C SecPath F1000-E - Manual (Page 114)

104
Figure 103 Adding an ASPF policy
4. Configure the parameters as described in Table 41 .
5. Click Apply.
Table 41 Configuration items
Item Description
Source Zone
Select a source/destination zone to which the ASPF policy will be
applied.
Dest Zone
Discard ICMP error packets
Set whether to discard ICMP error packets.
If this box is not selected, ICMP error packets are allowed to pass.
Discard non-SYN initial TCP packets
Set whether to discard initial TCP packets that are not SYN packets.
If this box is not selected, initial TCP packets that are not SYN packets
are allowed to pass.
ASPF configuration example
Network requirements
As shown in Figure 104 , configure an ASPF policy between zone 1 and zone 2 to discard ICMP error
packets but permit initial TCP packets that are not SYN packets.
Figure 104 Network diagram