HP E3800 Series, Access Security Manual

Page: 450 / 732

10-70
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Options for ICMP Traffic in Extended ACLs. This option is useful
where it is necessary to permit some types of ICMP traffic and deny other
types, instead of simply permitting or denying all types of ICMP traffic. That
is, an ACE designed to permit or deny ICMP traffic can optionally include an
ICMP type and code value to permit or deny an individual type of ICMP packet
while not addressing other ICMP traffic types in the same ACE. As an optional
alternative, the ACE can include the name of an ICMP packet type. (For a
summary of the extended ACL syntax options, refer to table on page 10-59.)
Syntax: < deny | permit > icmp < SA > < DA > [ icmp-type [ icmp-code ]
< deny | permit > icmp < SA > < DA > [ icmp-type-name ]
[ ] | ]
In an extended ACL using
icmp
as the packet protocol type
(see above), you can optionally specify an individual
ICMP packet type or packet type/code pair to further define
the criteria for a match. This option, if used, is entered
immediately after the destination address (DA) entry. The
following example shows two ACEs entered in a Named
ACL context:
#permit icmp any any host-unknown
#permit icmp any any 3 7
[ icmp-type [ icmp-code ] ]
This option identifies an individual ICMP packet type as
criteria for permitting or denying that type of ICMP traffic
in an ACE.
• icmp-type —
This value is in the range of 0 - 255 and
corresponds to an ICMP packet type.
• icmp-code —
This value is in the range of 0 - 255 and
corresponds to an ICMP code for an ICMP packet type.
For more information on ICMP type names, visit the
Internet Assigned Numbers Authority (IANA) website at
www.iana.com, click on “Protocol Number Assignment Ser-
vices”, and then go to the selections under “Internet Control
Message Protocol (ICMP) Parameters”.