User's Manual

MP252 Multimedia Home Gateway 14. Security
Version 3.4.0 239 June 2011
2. In the section 'Matching', define a match between IP addresses and a traffic protocol:
a. Configure the source address of the packets sent to or received from the network
object. To add an address, select the option 'User Defined' from the drop-down list;
the screen 'Edit Network Object' appears.
Figure 14-27: Add a Specific Host
Click the New
icon; this commences a sequence that adds a new network
object.
b. Configure the destination address of the packets sent to or received from the
network object. This address can be configured in the same manner as the source
address.
c. From the 'Protocol' drop-down list, select a specific traffic protocol or add a new
one (by selecting 'User Defined'); the 'Edit Services' screen appears. Click the link
New Server Ports; this commences a sequence that adds a new protocol.
3. Select the check box 'DSCP' to mark a DSCP value on packets matching this rule; the
screen refreshes, allowing you to enter the hexadecimal value of the DSCP.
4. Select the check box 'Priority' to add a priority to the rule; the screen refreshes, allowing
you to select between one of eight priority levels, zero being the lowest and seven the
highest (each priority level is mapped to low/medium/high priority). This sets the priority
of a packet on the connection matching the rule, while routing the packet.
Figure 14-28: Set Priority Rule
5. Select the check box 'Length' to specify the length of packets or the length of their data
portion.
6. In the section 'Operation', define the action of the rule:
• Drop: Deny access to packets that match the source and destination IP addresses
and service ports defined in 'Matching'.
• Reject: Deny access to packets that match the source and destination IP
addresses and service ports defined in 'Matching' and sends and sends an ICMP
error or a TCP reset to the origination peer.
• Accept Connection: Allow access to packets that match the source and
destination IP addresses and service ports defined in 'Matching'. The data transfer
session is handled using Stateful Packet Inspection (SPI).