x values. (E.g. 18.102.130.2, 192.168.131.125)
192.0.125.0
255.0.253.0
Matches source addresses 192.x.125.x and 192.x.127.x, regardless
of the x values. (E.g. 192.142.125.8, 192.3.127.135)
192.0.125.0
254.0.253.0
Matches source addresses 192.x.125.x, 193.x.125.x, 192.x.127.x
and 193.x.127.x, regardless of the x values. (E.g. 192.222.125.44,
193.111.127.201)
So that the user better understands the concepts associated to wildcard configuration,
the positions of the mask bits
whose values are 0, must also be 0 in the address.
Otherwise, the device will issue an error message and suggest
an address that adapts to the mask provided. The user must check whether this address matches the required con-
figuration.
For example, if you try to enter address 172.24.155.130 in the command with mask 255.255.254.255, the device will
issue an error message. This is because the last bit in the mask's third octet (254) does not match the one in the ad-
dress (155). In this case, the device will suggest address 172.24.154.130.
When configuring an IP address, you must enter the IP address and the mask. When configuring an interface, you
must enter its number.
Syntax:
a) IP Address
Extended Access List #>entry <id> source address <address> <mask>
b) Interface
Extended Access List #>entry <id> source address interface <interface>
Example:
a) IP Address
Extended Access List 100>entry 3 source address 192.168.4.5 255.255.255.255
Extended Access List 100>
Extended Access List 100>entry 4 source address 192.0.0.17 255.0.0.255
Extended Access List 100>
b) Interface
Extended Access List 100>entry 3 source address interface serial0/0
Extended Access List 100>
Caution
An interface should only be configured as source in those access lists that are going to be associated
to IPSec. Since this option is currently not applied to the rest of protocols and features, it should not be
configured.
2.5.2.4.2 ENTRY <id> SOURCE PORT-RANGE
The meaning of this command depends on the type of protocol used in the packet that’s being filtered.
• If the packet corresponds to TCP or UDP, this command establishes the sentence for the packet source port and
must be followed by two numbers. The first indicates the port identifier in the lower port range and the second is
the identifier in the higher port range. If you do not want a range, simply enter two equal values. Both port identifi-
ers can take values between 0 and 65535.
In this case, the aim of this command is to grant or deny access to various TCP or UDP source ports.
• If the packet corresponds to the ICMP protocol and the entry is configured to carry out filtering over this protocol
(using command entry <id> protocol icmp), this command establishes the sentence for the ICMP packet code.
This must be followed by two numbers used to specify a range. The first indicates the type of ICMP message used
as the lower range limit, while the second indicates the higher range limit. If you don’t want to establish a range,
simply enter two equal values
In this case, the aim of this command is to grant or deny certain ICMP messages or a set of types.
Please note that ICMP in the entry can only be configured using the entry <id> protocol icmp command.
• If this command is configured, then a packet is only a match if it complies with all of the above.
bintec elmeg
2 Configuration
Access Control
15
