Dell PowerConnect W-7200 Series, Reference Manual

Page: 354 / 1538

354 | ip access-list session Dell PowerConnect W-Series ArubaOS 6.2 | Reference Guide
Parameter Description
l
tunnel: Specify the ID of the tunnel configured with the interface tunnel command.
route: Specify the next hop to which packets are routed, which can be one of the following:
l
dst-nat: Destination IP changes to the IP configured from the NAT pool. This action functions in
bridge/split-tunnel forwarding mode. User should configure the NAT pool in the controller.
l
src-nat:Source IP changes to RAP’s external IP. This action functions in bridge/split-tunnel
forwarding mode and uses implied NAT pool.
src-nat: Performs source NAT on packets. Source IP changes to the outgoing interface IP address
(implied NAT pool) or from the pool configured (manual NAT pool). This action functions in
tunnel/decrypt-tunnel forwarding mode.
<extended ac
tion>
Optional action if rule is applied, which can be one of the following:
blacklist: blacklist user if ACL gets applied.
classify-media: Monitors user UDP packets to classify them as media and tag accordingly.
WARNING: Use this parameter only for voice and video signaling and control sessions as it causes
deep packet inspection of all UDP packets from/to users.
disable-scanning: pause ARM scanning while traffic is present. Note that you must enable “VoIP
Aware Scanning” in the ARM profile for this feature to work.
dot1p-priority: specify 802.1p priority (0-7)
log: generate a log message
mirror: mirror all session packets to datapath or remote destination
If you configure the mirror option, define the destination to which mirrored packets are sent in the
firewall policy. For more information, see
"firewall" on page 263 .
next-hop-list: Route packet to the next hop in the list.
position: specify the position of the rule (1 is first, default is last)
queue: assign flow to priority queue (high/low)
send-deny-response: if <action> is deny, send an ICMP notification to the source
time-range: specify time range for this rule (configured with time-range command)
tos: specify ToS value (0-63)
no
Negates any configured parameter.
Usage Guidelines
Session ACLs define traffic and firewall policies on the controller. You can configure multiple rules for each policy,
with rules evaluated from top (1 is first) to bottom. The first match terminates further evaluation. Generally, you
should order more specific rules at the top of the list and place less specific rules at the bottom of the list. The ACL
ends with an implicit deny all. To configure IPv6 rules, use the
ipv6
keyword followed by the regular ACL keywords.
Example
The following command configures a session ACL that drops any traffic from 10.0.0.0 subnetwork:
ip access-list session drop-from10
network 10.0.0.0 255.0.0.0 any any
The following command configures a session ACL with IPv4 and IPv6 address:
(host) (config)#ip access-list session common
(host) (config-sess-common)#host 10.12.13.14 any any permit
(host) (config-sess-common)#ipv6 host 11:12:11:11::2 any any permit
The following example displays information for an ACL.
(host) (config-sess-common)#show ip access-list common
ip access-list session common
common