For S-series switches (except S1700) and E-series switches, the TCP connection establishment process includes three handshakes, and the handshake data sent by the passive party carries RST or ACK flags, and does not carry other flags such as SYN, etc. Therefore, it is only necessary to configure ACLs on the passive party to allow TCP messages carrying RST or ACK to pass, and disallow TCP messages carrying other flags to pass. TCP messages carrying RST or ACK are allowed to pass, and TCP messages