Dell Brocade DCX, Configuration Manual

Page: 596 / 1436

524 BigIron RX Series Configuration Guide
53-1001810-01
Configuring numbered and named ACLs
21
Parameters to filter TCP or UDP packets
Use the parameters below if you want to filter traffic with the TCP or UDP packets. These
parameters apply only if you entered tcp or udp for the
<ip-protocol> parameter. For example, if
you are configuring an entry for HTTP, specify tcp eq http.
first-fragment Enter this keyword if you want to filter only the first-fragmented packets. Refer to
“Enabling ACL filtering of fragmented or non-fragmented packets” on page 557.
fragment-offset <number> Enter this parameter if you want to filter a specific fragmented packets. Enter a
value from 0 – 8191. Refer to
“Enabling ACL filtering of fragmented or
non-fragmented packets” on page 557.
NOTE: fragment, non-fragment, first-fragment, and fragment-offset may not be used together in the same ACL
statement.
log Add this parameter to the end of an ACL statement to enable the generation of
SNMP traps and Syslog messages for packets denied by the ACL.You can enable
logging on ACLs and filters that support logging even when the ACLs and filters are
already in use. To do so, re-enter the ACL or filter command and add the log
parameter to the end of the ACL or filter. The software replaces the ACL or filter
command with the new one. The new ACL or filter, with logging enabled, takes
effect immediately.
NOTE: Logging must be enable on the interface to which the ACL is bound before
SNMP traps and Syslog messages can be generated, even if the log
parameter is entered. Refer to
“ACL logging” on page 544.
<operator> Specifies a comparison operator for the TCP or UDP port number. You can enter one
of the following operators:
•
eq – The policy applies to the TCP or UDP port name or number you enter after
eq.
•
gt – The policy applies to TCP or UDP port numbers greater than the port
number or the numeric equivalent of the port name you enter after gt.
•
lt – The policy applies to TCP or UDP port numbers that are less than the port
number or the numeric equivalent of the port name you enter after lt.
•
neq – The policy applies to all TCP or UDP port numbers except the port number
or port name you enter after neq.
•
range – The policy applies to all TCP or UDP port numbers that are between the
first TCP or UDP port name or number and the second one you enter following
the range parameter. The range includes the port names or numbers you enter.
For example, to apply the policy to all ports between and including 23 (Telnet)
and 53 (DNS), enter the following: range 23 53. The first port number in the
range must be lower than the last number in the range.
•
established – This operator applies only to TCP packets. If you use this operator,
the policy applies to TCP packets that have the ACK (Acknowledgment) or RST
(Reset) bits set on (set to “1”) in the Control Bits field of the TCP packet header.
Thus, the policy applies only to established TCP sessions, not to new sessions.
Refer to Section 3.1, “Header Format”, in RFC 793 for information about this
field.
NOTE: This operator applies only to destination TCP ports, not source TCP ports.