回复：限制SSH方式登陆的IP地址

启动IBM ，ipsec4过滤规则

# smitty ipsec4
-> Start/Stop IP Security
-> Start IP Security ->

Start IP Security

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

[Entry Fields]
Start IP Security [Now and After Reboot] +
Deny All Non_Secure IP Packets [no] +

检查ipsec现在可用：
# lsdev -Cc ipsec
ipsec_v4 Available IP Version 4 Security Extension

现在系统中应创建了两个过滤规则。使用下面的命令检查这两个过滤规则：
# lsfilt -v4
Beginning of IPv4 filter rules.
Rule 1:
Rule action : permit
Source Address : 0.0.0.0
Source Mask : 0.0.0.0
Destination Address : 0.0.0.0
Destination Mask : 0.0.0.0
Source Routing : no
Protocol : udp
Source Port : eq 4001
Destination Port : eq 4001
Scope : both
Direction : both
Logging control : no
Fragment control : all packets
Tunnel ID number : 0
Interface : all
Auto-Generated : yes

Rule 2:
*** Dynamic filter placement rule for IKE tunnels ***
Logging control : no
.
Rule 0:
Rule action : permit
Source Address : 0.0.0.0
Source Mask : 0.0.0.0
Destination Address : 0.0.0.0
Destination Mask : 0.0.0.0
Source Routing : yes
Protocol : all
Source Port : any 0
Destination Port : any 0
Scope : both
Direction : both
Logging control : no
Fragment control : all packets
Tunnel ID number : 0
Interface : all
Auto-Generated : no
.
End of IPv4 filter rules.

增加一个过滤规则以允许接受从9.3.6.180发来的ftp请求：
# smitty ipsec4
-> Advanced IP Security Configuration
-> Configure IP Security Filter Rules
-> Add an IP Security Filter Rule ->

Add an IP Security Filter Rule

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

[Entry Fields]
* Rule Action [permit]
+
* IP Source Address [9.3.6.180]
* IP Source Mask [255.255.255.255]
IP Destination Address [9.3.6.177]
IP Destination Mask [255.255.255.255]
* Apply to Source Routing? (PERMIT/inbound only) [yes]
+
* Protocol [all]
+
* Source Port / ICMP Type Operation [any]
+
* Source Port Number / ICMP Type [0]
#
* Destination Port / ICMP Code Operation [eq]
+
* Destination Port Number / ICMP Type [21]
#
* Routing [both]
+
* Direction [both]
+
* Log Control [no]
+
* Fragmentation Control [all packets]
+
* Tunnel ID [0]
+#
* Interface [all]
+

增加另一个过滤规则以拒绝其它所有向 9.3.6.177发出的ftp请求：
Add an IP Security Filter Rule

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

[Entry Fields]
* Rule Action [deny]
+
* IP Source Address [0.0.0.0]
* IP Source Mask [0.0.0.0]
IP Destination Address [9.3.6.177]
IP Destination Mask [255.255.255.255]
* Apply to Source Routing? (PERMIT/inbound only) [yes]
+
* Protocol [all]
+
* Source Port / ICMP Type Operation [any]
+
* Source Port Number / ICMP Type [0]
#
* Destination Port / ICMP Code Operation [eq]
+
* Destination Port Number / ICMP Type [21]
#
* Routing [both]
+
* Direction [both]
+
* Log Control [no]
+
* Fragmentation Control [all packets]
+
* Tunnel ID [0]
+#
* Interface [all]
+

激活设置的过滤规则：
# smitty ipsec4
-> Advanced IP Security Configuration
-> Activate/Update/Deactivate IP Security Filter Rule
-> Activate / Update

上面是配置了一个FTP的过滤规则，你只要将端口改为22就是现在ssh登录了。