How you configure filters depends on the following decisions:
You should enable filtering support if you want to control access to services on your network. Filters increase security by limiting the visibility of selected services. Packet forwarding filters provide the highest level of security.
Enabling filtering reduces network traffic caused by periodic service information messages sent by routers.
Before you begin, make sure that the Filter Support option is enabled in the Novell® Internet Access Server Configuration utility (NIASCFG) for each protocol that needs filtering.
NOTE: When Filter Support is disabled, the protocol operates as if the filter module is not loaded, and no filtering occurs. However, the changes you make will have no effect until you enable Filter Support. When Filter Support is enabled, any changes you make to the filter configurations take effect immediately. It is not necessary to use the REINITIALIZE SYSTEM command.
To set up and modify filters, complete the following steps:
Load FILTCFG.
The Filter Configuration Available Options menu is displayed.
Select the protocol for which you want to configure filters.
The main filter menu for the protocol you selected is displayed.
Optionally, for IPX and IP filtering, select Global Logging and select Enabled to log packets that match the Filters or Exceptions definitions.
The header of packets that match the Filters or Exceptions definitions are logged as long as the global logging status and the filters or exceptions logging status are both enabled. The logs are viewed using the NetWare Administrator utility.
Select the type of filter you want.
The corresponding option menu is displayed.
For each option you select, you can configure the following general parameters:
When the action is permitted, the specified filters are accepted; any filters that are not explicitly permitted are denied. One of the following occurs:
Packets matching the entries in the Packet Forwarding List are allowed through.
Services or routes matching the entries in the Outgoing Service/Routing Information Filter Lists are advertised.
Services or routes matching the entries in the Incoming Service/Routing Information Filter Lists are accepted.
If the action is denied, the specified filters are denied (the packets are discarded); any filters that are not explicitly denied are permitted.
You can select a filter from the list and press Enter to modify the filter or Del to remove it. Press Ins to add a new filter.
Refer to the corresponding section later in this chapter for the steps you use to define a filter if you are modifying or adding a filter.
The Exceptions list is examined before the Filters list. If there is a conflict between the two lists, the Exceptions list is used. The action taken on the Exceptions list is always the opposite of the action taken on the Filters list.
You select a filter from the list and press Enter to modify the filter or Del to remove it. Press Ins to add a new filter. For example, you could use a filter to hide all Marketing file servers from Engineering, except the server named MKTG-DEMO.
Press Esc to exit.
NOTE: All filters affecting a primary call are automatically mapped to a configured backup call. Optionally, the automatic mapping of filtering can be disabled with the LOAD FILTSRV NOBACKUP command. With automatic mapping of filtering disabled, you can configure a selective filtering scheme that is specific to the needs of a backup link. The primary call and its associated backup call should use the same remote system ID. For information on configuring backup calls, refer to "Configuring Backup Calls.”
To save your filter information to a text file, complete the following steps:
Load FILTCFG.
The Filter Configuration Available Options menu is displayed.
Select Save Filters to a Text File, then press Enter.
Enter the pathname for the filter file.
For example, enter SYS:\ETC\TEMP. You can also save the filter file to a floppy disk (for example, A:\filename).