
168
Access Control List Configuration
msg
name
The ICMP message name. The following are valid message names:
administratively-prohibited, alternate-address, conversion-error, dod-host-
prohibited, dod-net-prohibited, echo, echo-reply, general-parameter-problem,
host-isolated, host-precedence-unreachable, host-redirect, host-tos-redirect, host-
tos-unreachable, host-unknown, host-unreachable, information-reply,
information-request, mask-reply, mask-request, mobile-redirect, net-redirect, net-
tos-redirect, net-tos-unreachable, net-unreachable, network-unknown, no-room-
for-option, option-missing, packet-too-big, parameter-problem, port-unreachable,
precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect,
router-advertisement, router-solicitation, source-quench, source-route-failed,
time-exceeded, timestamp-reply, timestamp-request, traceroute, ttl-exceeded,
unreachable
type
type
The ICMP message type. A number from 0 to 255 (inclusive)
code
code
The ICMP message code. A number from 0 to 255 (inclusive)
cos
Optional. Specifies that packets matched by this rule belong to a certain Class of
Service (CoS). For detailed description of CoS configuration refer to chapter
“Quality of Service Configuration” later in this guide.
group
CoS group name.
If you place a
deny ip any any
rule at the top of an access-list profile, no packets will pass regardless of
the other rules you defined.
Example: Create ICMP Access Control List Entries
Select the access-list profile named WanRx and create the rules to filter all ICMP echo requests (as
used by the ping command).
SN(cfg)#
profile acl WanRx
SN(pf-acl)[WanRx]#
deny icmp any any type 8 code 0
SN(pf-acl)[WanRx]#
exit
SN(cfg)#
The same effect can also be obtained by using the simpler message name option. See the following
example.
SN(cfg)#
profile acl WanRx
SN(pf-acl)[WanRX]#
deny icmp any any msg echo
SN(pf-acl)[WanRX]#
exit
SN(cfg)#
19.7 Add a TCP, UDP or SCTP Filter Rule to the Current
Access Control List Profile
The commands
permit
or
deny
are used to define a TCP, UDP or SCTP filter rule. Each TCP, UDP or
SCTP filter rule represents a respective access of control list entry.
Procedure
To create a TCP, UDP or SCTP access control list entry that
permits access
Mode
Profile access control list
Software Configuration Guide, Revision 1.03
Summary of Contents for SmartWare R2.00
Page 2: ......