Intel 480T, User Manual

Page: 258 / 367

256
C H A P T E R 1 4 Access Policies
The
established
Keyword
Access lists support the use of the
established
keyword. This
keyword allows directional control of attempts to open a TCP
session. Sessions can be explicitly permitted in the entry. For
example, the following entry permits TCP sessions originated from
anywhere in the 10.1.0.0 network, only:
create access-list TCPout tcp destination 10.1.0.0/
16 range any source 0.0.0.0/0 range any permit-
established port any
In this example, the
established
keyword allows only TCP
packets with the ACK or RST bit set to destination 10.1.0.0. from
anywhere, but not to any other destination.
Adding and Deleting Access List Entries
You can add and delete entries in the access list. To add an entry,
you must supply a unique name and, optionally, a unique
precedence number. To modify an existing entry, you must delete
the entry and retype it, or create a new entry with a new unique
name.
To delete an access list entry, use the command:
delete access-list <name>
Maximum Entries
You can use up to a maximum of 255 entries with an assigned
precedence. In addition to the 255 entries, you can also create
entries that do not use precedence, with the following restrictions:
• A source IP address must use wild-cards or be completely
specified (32 bit mask).
• The layer 4 source and destination ports must use wildcards or be
completely specified (no ranges).
• No physical source port can be specified.
Access Lists for ICMP
Access lists for ICMP traffic processing are handled in a slightly
different manner. An access list for ICMP is only effective for
traffic routed by the switch. ICMP traffic may either be forwarded