3Com VCX V7122, User Manual, Page: 354 / 488

354
V7122 GatewayUser Guide
ƒ Mix allowed and blocked network sources
ƒ Limit traffic to a predefined rate (blocking the excess)
ƒ Limit traffic to specific protocols, and specific port ranges on the device
The access list consists of a table with up to 50 ordered lines. For each packet received on
the network interface, the table is scanned from the top until a matching rule is found (or the
table end is reached). This rule can either block the packet or allow it; however it is important
to note that subsequent rules aren’t scanned. If the table end is reached without a match, the
packet is accepted.
Each rule is composed of the following fields (described in Table 35 ):
ƒ IP address (or DNS name) of source network
ƒ IP network mask
ƒ Destination UDP/TCP ports (on this device)
ƒ Protocol type
ƒ Maximum packet size, byte rate per second, and allowed data burst
ƒ
Action upon match (allow or block)
Figure 116 shows an example of an access list definition using ini file:
Figure 116
Example of an Access List Definition using ini File
[ ACCESSLIST ]
FORMAT AccessList_Index = AccessList_Source_IP, AccessList_Net_Mask,
AccessList_Start_Port, AccessList_End_Port, AccessList_Protocol,
AccessList_Packet_Size, AccessList_Byte_Rate, AccessList_Byte_Burst,
AccessList_Allow_Type;
AccessList 10 = mgmt.customer.com, 255.255.255.255, 0, 80, tcp, 0, 0, 0, allow
;
AccessList 15 = 192.0.0.0, 255.0.0.0, 0, 65535, any, 0, 40000, 50000, block ;
AccessList 20 = 10.31.4.0, 255.255.255.0, 4000, 9000, any, 0, 0, 0, block ;
AccessList 22 = 10.4.0.0, 255.255.0.0, 4000, 9000, any, 0, 0, 0, block ;
[ \ACCESSLIST ]
Explanation of the example access list:
ƒ Rule #10: traffic from the host ‘mgmt.customer.com’ destined to TCP ports 0 to 80, is
always allowed.
ƒ Rule #15: traffic from the 192.xxx.yyy.zzz subnet, is limited to a rate of 40 Kbytes per
second (with an allowed burst of 50 Kbytes). Note that the rate is specified in bytes, not
bits, per second; a rate of 40000 bytes per second, nominally corresponds to 320 kbps.
ƒ Rule #20: traffic from the subnet 10.31.4.xxx destined to ports 4000 to 9000 is always
blocked, regardless of protocol.