Inalp Networks SmartWare Release 2.10, Software Configuration Manual

Page: 171 / 357

Access Control List Configuration 171
19.11 Examples
19.11.1 Deny a Specific Subnet
Figure 19-2 shows an example in which a server attached to network 172.16.1.0 shall not be accessible
from outside networks connected to IP interface
lan of the SmartNode device. Therefore an incoming
filter rule named Jamming is defined, which blocks any IP traffic from network 172.16.2.0 and has to
be bound to IP interface lan .
Figure 19-2: Deny a Specific Subnet on an Interface
The commands that have to be entered are listed below. The commands access the SmartNode device
via a Telnet session running on a host with IP address 172.16.2.13, which accesses the SmartNode via
IP interface
lan .
172.16.2.1> enable
172.16.2.1# configure
172.16.2.1(cfg)# profile acl Jamming
172.16.2.1(pf-acl)[Jamming]# deny ip 172.16.2.0 0.0.0.255 172.16.1.0
0.0.0.255
172.16.2.1(pf-acl)[Jamming]# permit ip any any
172.16.2.1(pf-acl)[Jamming]# exit
172.16.2.1(cfg)# context ip router
172.16.2.1(cfg-ip)[router]# interface lan
172.16.2.1(if-ip)[lan]# use profile acl Jamming in
172.16.2.1(if-ip)[lan]# exit
172.16.2.1(cfg-ip)# copy running-config startup-config
Software Configuration Guide Release 2.10, Revision 1.00