166
Access Control List Configuration
Mode
Profile access control list
Command
Purpose
Step 1
node
(pf-acl)[
name
]#deny ip
{
src
src-wildcard
|
any
|
host
src
} {
dest
dest-wildcard
|
any | host
dest
} [cos
group
]
Creates an IP access of control list
entry that denies access defined
according to the command options
Where the syntax is:
Keyword
Meaning
src
The source address to be included in the rule. An IP address in dotted-decimal-
format, e.g. 64.231.1.10.
src-wildcard
A wildcard for the source address. Expressed in dotted-decimal format this value
specifies which bits are significant for matching. One-bits in the wildcard indicate
that the corresponding bits are ignored. An example for a valid wildcard is
0.0.0.255, which specifies a class C network.
any
Indicates that IP traffic to or from all IP addresses is to be included in the rule.
host
src
The address of a single source host.
dest
The destination address to be included in the rule. An IP address in dotted-
decimal-format, e.g. 64.231.1.10.
dest-wildcard A wildcard for the destination address. See
src-wildcard
host dest
The address of a single destination host.
cos
Optional. Specifies that packets matched by this rule belong to a certain Class of
Service (CoS). For detailed description of CoS configuration refer to chapter
“Quality of Service Configuration” later in this guide.
group
CoS group name.
If you place a
deny ip any
rule at the top of an access control list profile, no packets will pass
regardless of the other rules you defined.
Example: Create IP Access Control List Entries
Select the access-list profile named WanRx and create some filter rules for it.
SN(cfg)#
profile acl WanRx
SN(pf-acl)[WanRx]#
permit ip host 62.1.2.3 host 193.14.2.11 cos Urgent
SN(pf-acl)[WanRx]#
permit ip 62.1.2.3 0.0.255.255 host 193.14.2.11
SN(pf-acl)[WanRx]#
permit ip 97.123.111.0 0.0.0.255 host 193.14.2.11
SN(pf-acl)[WanRx]#
deny ip any any
SN(pf-acl)[WanRx]#
exit
SN(cfg)#
19.6 Add an ICMP Filter Rule to the Current Access
Control List Profile
The command
permit
or
deny
are used to define an ICMP filter rule. Each ICMP filter rule
Software Configuration Guide, Revision 1.03
represents an ICMP access of control list entry.
Summary of Contents for SmartWare R2.00
Page 2: ......