Deactivating and Disabling IP Filter

You might want to deactivate or disable packet filtering and NAT under the following circumstances:

• For testing purposes

• To troubleshoot system problems when you think the problems are caused by IP Filter

The following task map identifies the procedures associated with deactivating or disabling IP Filter features.

Table 21-2 Deactivating and Disabling IP Filter (Task Map)

How to Deactivate Packet Filtering

The following procedure deactivates IP Filter packet filtering by flushing the packet filtering rules from the active filtering rule set. The procedure does not disable IP Filter. You can reactivate IP Filter by adding rules to the rule set.

1. Assume a role that includes the IP Filter Management rights profile, or become superuser.

   You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Use one of the following methods to deactivate IP Filter rules:

   • Remove the active rule set from the kernel.

     # ipf -Fa

     This command deactivates all packet filtering rules.

   • Remove incoming packet filtering rules.

     # ipf -Fi

     This command deactivates packet filtering rules for incoming packets.

   • Remove outgoing packet filtering rules.

     # ipf -Fo

     This command deactivates packet filtering rules for outgoing packets.

How to Deactivate NAT

The following procedure deactivates IP Filter NAT rules by flushing the NAT rules from the active NAT rules set. The procedure does not disable IP Filter. You can reactivate IP Filter by adding rules to the rule set.

1. Assume a role that includes the IP Filter Management rights profile, or become superuser.

   You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Remove NAT from the kernel.

   # ipnat -FC

   The -C option removes all entries in the current NAT rule listing. The -F option removes all active entries in the current NAT translation table, which shows the currently active NAT mappings.

How to Disable Packet Filtering

When you run this procedure, both packet filtering and NAT are removed from the kernel. If you use this procedure, you must re-enable IP Filter in order to reactivate packet filtering and NAT. For more information, see How to Re-Enable IP Filter.

1. Assume a role that includes the IP Filter Management rights profile, or become superuser.

   You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Disable packet filtering and allow all packets to pass into the network.

   # ipf –D

   ---

   Note - The ipf -D command flushes the rules from the rule set. When you re-enable filtering, you must add rules to the rule set.

   ---