Subject: (usr-tc) Hiper Arc Filters

From: Scott Bailey <[email-masked]>
Date: Mon, 10 Jul 2000 23:26:00 +0000

Hi,

I am having trouble configuring and assighning filters
dynamicly with radius on the Hiper Arcs. This is what
I have.

On the Hiper Arc:

filter.fil

#filter
IP:

005 AND src-addr = 0.0.0.0/0;
010 ACCEPT dst-addr = 216.32.74.50;
015 AND dst-addr = 0.0.0.0/0;
020 REJECT tcp-dst-port = 80;
025 AND dst-addr = 0.0.0.0/0;
030 REJECT tcp-dst-port = 443;
035 AND dst-addr = 0.0.0.0/0;
040 REJECT tcp-dst-port = 119;
045 AND dst-addr = 0.0.0.0/0;
050 REJECT tcp-dst-port = 6667;
055 AND dst-addr = 0.0.0.0/0;
060 REJECT udp-dst-port = 6667;
070 DENY;

In Radius:

Filter_ID=filter.fil,

Show session (user ID) indicates that the Filter_ID radius attribute
was picked up by the NAS. However, it does not block any of the
ports defined in the filter. Do I need to configur something else?

Thanks in advance for any help.

-- 
Scott Bailey
Systems Administrator 
Epix Internet Services
[email-masked]
570-631-1317

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Ved <[email-masked]>
Date: Mon, 10 Jul 2000 23:42:55 +0000

Make sure that filter access is enabled for all modem-groups,
make sure that you have this filter named as filter.fil.in
and also that you have a filter called filter.fil.out (empty dummy filter
is good).  This is needed for the filter to work.

-V

-

---

From: Scott Bailey <[email-masked]>
Date: Tue, 11 Jul 2000 02:52:11 +0000

----- Original Message ----- 
From: "Ved" <[email-masked]>
Subject: Re: (usr-tc) Hiper Arc Filters

> Make sure that filter access is enabled for all modem-groups,

Thanks. Would you have an example of the syntax to do that on
a Hiper Arc.

> is good).  This is needed for the filter to work.

That makes sense. I can see it is trying to append .in and .out to the filter
name, however the documentation (At least not that I could find) doesn't
mention that as a consideration in naming the filters. It seemed the documentation
for the Netservers was a little more thorough.

Thanks for the assistance.

------
Scott Bailey
Systems Administrator 
Epix Internet Services
[email-masked]
570-631-1317

-

---

From: [email-masked]
Date: Tue, 11 Jul 2000 03:56:25 +0000

> Thanks. Would you have an example of the syntax to do that on

set modem_group all filter_access on

> for the Netservers was a little more thorough.
Well the initial release of hiper arc (4.0) did not use this - but then the 
problem was that users of netservers did not like this option.  Thus from 
4.0.39 upwards the HiPer arc required filters to have .in and .out - or you can 
use the VSA Framed-ip-filter attribute that will allow you to send either input 
or output filter.

-V

-