Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 81)

Brocade ICX 6650 Security Configuration Guide 61
53-1002601-01
TCP Flags - edge port security
Example
Brocade(config-ext-nACL)# permit tcp 10.1.1.1 0.0.0.255 eq 100 10.2.2.2
0.0.0.255 eq 300 match-all +urg +ack +syn -rst
This command configures a single rule in CAM hardware. This rule will contain all of the configured
TCP flags (urg, ack, syn, and rst).
Using TCP Flags in combination with other ACL features
The TCP Flags feature has the added capability of being combined with other ACL features.
Example
Brocade(config-ext-nACL)# permit tcp any any match-all +urg +ack +syn -rst
traffic-policy test
This command configures the ACL to match incoming traffic with the TCP Flags urg, ack, and syn
and also to apply the traffic policy (rate, limit, etc.) to the matched traffic.
Brocade(config-ext-nACL)# permit tcp any any match-all +urg +ack +syn -rst tos
normal
This command configures the ACL to match incoming traffic with the flags urg, ack, and syn, and
also sets the tos bit to normal when the traffic exits the device.
NOTE
TCP Flags combines the functionality of older features such as TCP Syn Attack and TCP Establish.
Avoid configuring these older features on a port where you have configured TCP Flags. TCP Flags can
perform all of the functions of TCP Syn Attack and TCP Establish, and more. However, if TCP Syn
Attack is configured on a port along with TCP Flags, TCP Syn Attack will take precedence.
NOTE
If an ACL clause with match-any exists, and the system runs out of CAM, if the total number of TCP
rules to TCP Flags will not fit within 1021 entries (the maximum rules allowed per device), then none
of the TCP Flag rules will be programmed into the CAM hardware.
NOTE
If a range option and match-any TCP-flags are combined in the same ACL, the total number of rules
will be calculated as: Total number of rules in CAM hardware = (number of rules for range)* (number
of rules for match-any TCP-flags).