Inalp Networks SmartWare Release 2.10, Software Configuration Manual

Page: 165 / 357

Access Control List Configuration 165
Software Configuration Guide Release 2.10, Revision 1.00
If you place a deny ip any any rule at the top of an access-list profile, no packets will pass regardless of
the other rules you defined.
Procedure
To create an ICMP access control list entry that denies access
Mode
Profile access control list
Command Purpose
Step 1 node (pf-acl)[ name ]#deny icmp { src src-wildcard
| any | host src } { dest dest-wildcard | any | host
dest } [msg name | type type | type type code
code ] [ cos group ]
Creates an ICMP access of control
list entry that denies access
defined according to the command
options
Where the syntax is as following:
Keyword Meaning
src The source address to be included in the rule. An IP address in dotted-decimal-
format, e.g. 64.231.1.10.
src-wildcard A wildcard for the source address. Expressed in dotted-decimal format this value
specifies which bits are significant for matching. One-bits in the wildcard indicate
that the corresponding bits are ignored. An example for a valid wildcard is
0.0.0.255, which specifies a class C network.
any Indicates that IP traffic to or from all IP addresses is to be included in the rule.
host src The address of a single source host.
dest The destination address to be included in the rule. An IP address in dotted-
decimal-format, e.g. 64.231.1.10
dest-wildcard A wildcard for the destination address. See src-wildcard .
host dest The address of a single destination host.
msg name The ICMP message name. The following are valid message names:
administratively-prohibited, alternate-address, conversion-error, dod-host-
prohibited, dod-net-prohibited, echo, echo-reply, general-parameter-problem,
host-isolated, host-precedence-unreachable, host-redirect, host-tos-redirect, host-
tos-unreachable, host-unknown, host-unreachable, information-reply,
information-request, mask-reply, mask-request, mobile-redirect, net-redirect, net-
tos-redirect, net-tos-unreachable, net-unreachable, network-unknown, no-room-
for-option, option-missing, packet-too-big, parameter-problem, port-unreachable,
precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect,
router-advertisement, router-solicitation, source-quench, source-route-failed,
time-exceeded, timestamp-reply, timestamp-request, traceroute, ttl-exceeded,
unreachable
type type The ICMP message type. A number from 0 to 255 (inclusive)
code code The ICMP message code. A number from 0 to 255 (inclusive)
cos Optional. Specifies that packets matched by this rule belong to a certain Class of
Service (CoS). For detailed description of CoS configuration refer to chapter
“Quality of Service Configuration” later in this guide.
group CoS group name.