H3C Technologies H3C Intelligent Management Center - Manual (Page 57)

47
Filter strategies consist of a name, description and default filter policy as well as one or more filter
conditions. There are two types of filter policies: the Discard filter, which discards any packet that
matches the filter conditions, and the Receive filter, which processes and reports on any packet that
matches the filter conditions. The Default Policy defines how log packets are treated by default when the
conditions of the packet do not match any of the filter conditions in the filter strategy.
A filter condition is a rule that defines the conditions under which log packets either are processed and
analyzed or discarded. A filter strategy can have many filter conditions, but every filter strategy must
have at least one filter condition. In addition, at least one of the filter conditions must contain a filter
policy that does not match the default filter policy.
NTA provides you the ability to tune very specifically which NetStream, NetFlow, or sFlow packets are
processed and which are discarded. You can filter by IP address as well as by port and protocol. In
addition, you can create multiple filter conditions for every filter strategy. And, every NTA server supports
an unlimited number of filter strategies. For example, you can create filter strategies for every device or
every VPN on every device that forwards NetStream, NetFlow, or sFlow traffic to NTA. Otherwise, you
can create filter strategies by port number or traffic type across all devices that forward flow traffic to NTA.
For example, you can create a simple filter that discards all ICMP traffic from NTA analysis and
reporting.
The following information describes NTA filtering features.
Viewing the filter strategy list
1. Select Service > Traffic Analysis and Audit > Settings.
2. In the Settings area of the Traffic Analysis and Audit page, click the Filter Strategy link.
NTA displays all filter strategies in the Filter Strategy List in the main pane of the Filter Strategy
Management page.
Filter strategy list contents
• Name—Contains the name for the associated filter strategy. The contents of this field link to
the Filter Strategy Details for the associated filter strategy.
• Description—Contains a description for the associated filter strategy.
• Modify—Contains a link to the Modify page for modifying the associated filter strategy.
• Delete—Contains an icon for deleting the associated filter strategy.
3. To query NTA for the current Filter Strategy List, click the Refresh button in the upper left corner of
the Filter Strategy List.
NOTE:
You can sort the Filter Strategy List by the Name and Description fields. Click the column label to sort the
list by the selected field. The column label allows you to toggle between the sort options specific to each
field.
Viewing the filter condition list
Every filter strategy includes a filter condition list that contains all of the filters for the associated filter
strategy. From this list, you can view the configuration parameters of a filter condition as well as sort and
delete filter conditions.