![background image](http://html1.mh-extra.com/html/patton-electronics/iplink-3210-series/iplink-3210-series_getting-started-manual_4070846064.webp)
Access control list configuration task list
64
IPLink 3210 Series Getting Started Guide
6 • Access control list configuration
Where the syntax is as following:
If you place a deny ip any any rule at the top of an access-list profile, no packets will pass regardless of the other
rules you defined.
Example:
Create ICMP access control list entries
Select the access-list profile named WanRx and create the rules to filter all ICMP echo requests (as used by the
ping command).
3210(cfg)#profile acl WanRx
3210(pf-acl)[WanRx]#deny icmp any any type 8 code 0
3210(pf-acl)[WanRx]#exit
3210(cfg)#
Keyword
Meaning
src
The source address to be included in the rule. An IP address in dotted-decimal-format, e.g.
64.231.1.10.
src-wildcard
A wildcard for the source address. Expressed in dotted-decimal format this value specifies
which bits are significant for matching. One-bits in the wildcard indicate that the corre-
sponding bits are ignored. An example for a valid wildcard is 0.0.0.255, which specifies
a class C network.
any
Indicates that IP traffic to or from all IP addresses is to be included in the rule.
host
src
The address of a single source host.
dest
The destination address to be included in the rule. An IP address in dotted-decimal-format,
e.g. 64.231.1.10
dest-wildcard
A wildcard for the destination address. See
src-wildcard.
host
dest
The address of a single destination host.
msg
name
The ICMP message name. The following are valid message names:
administratively-prohibited, alternate-address, conversion-error, dod-host-prohibited, dod-
net-prohibited, echo, echo-reply, general-parameter-problem, host-isolated, host-prece-
dence-unreachable, host-redirect, host-tos-redirect, host-tos-unreachable, host-unknown,
host-unreachable, information-reply, information-request, mask-reply, mask-request, mobile-
redirect, net-redirect, net-tos-redirect, net-tos-unreachable, net-unreachable, network-
unknown, no-room-for-option, option-missing, packet-too-big, parameter-problem, port-
unreachable, precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect,
router-advertisement, router-solicitation, source-quench, source-route-failed, time-exceeded,
timestamp-reply, timestamp-request, traceroute, ttl-exceeded, unreachable
type
type
The ICMP message type. A number from 0 to 255 (inclusive)
code
code
The ICMP message code. A number from 0 to 255 (inclusive)
cos
Optional. Specifies that packets matched by this rule belong to a certain Class of Service
(CoS). For detailed description of CoS configuration refer to chapter 7,
“Link scheduler
configuration”
on page 71.
group
CoS group name.
Summary of Contents for IPLink 3210 Series
Page 4: ...Summary Table of Contents IPLink 3210 Series Getting Started Guide 4...
Page 10: ...Table of Contents IPLink 3210 Series Getting Started Guide 10...
Page 18: ...About this guide IPLink 3210 Series Getting Started Guide 18...
Page 90: ...90 Chapter 8 LEDs status and monitoring Chapter contents Status LEDs 91...
Page 110: ...110 Appendix E IPLink 3210 Series factory configuration Chapter contents Introduction 111...
Page 112: ...112 Appendix F Installation checklist Chapter contents Introduction 113...