Alied Telesis GS970M/10, Справочник по командам

Страница: 919 / 1890

C613-50163-01 Rev C Command Reference for GS970M Series 919
AlliedWare Plus™ Operating System - Version 5.4.7-0.x
IP
V
4 S
OFTWARE
A
CCESS
C
ONTROL
L
IST
(ACL) C
OMMANDS
(
ACCESS
-
LIST EXTENDED
TCP UDP
FILTER
)
(access-list extended TCP UDP filter)
Overview Use this ACL filter to add a new TCP or UDP filter entry to the current extended
access-list. If the sequence number is specified, the new filter is inserted at the
specified location. Otherwise, the new filter is added at the end of the access-list.
The no variant of this command removes a TCP or UDP filter entry from the current
extended access-list. You can specify the TCP or UDP filter entry for removal by
entering either its sequence number (e.g.
no 10
), or by entering its TCP or UDP
filter profile without specifying its sequence number.
Note that the sequence number can be found by running the show access-list (IPv4
Software ACLs) command.
Syntax [tcp|udp]
[< sequence-number >] {deny|permit} {tcp|udp} < source > {eq
< sourceport > |lt < sourceport >|gt < sourceport >|ne < sourceport >}
< destination > [eq < destport >|lt < destport >|gt < destport >|ne
< destport >] [log]
no [< sequence-number >]{deny|permit} {tcp|udp} < source > {eq
< sourceport > |lt < sourceport >|gt < sourceport >|ne < sourceport >}
< destination > [eq < destport >|lt < destport >|gt < destport >|ne
< destport >] [log]
no < sequence-number >
Mode IPv4 Extended ACL Configuration
Default Any traffic controlled by a software ACL that does not explicitly match a filter is
denied.
Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the
sequence number is omitted, the next available multiple of 10 will be used as the
sequence number for the new filter. A new ACL filter can be inserted into the
middle of an existing list by specifying the appropriate sequence number.
NOTE
: The access control list being configured is selected by running the access-list
(extended numbered) command or the access-list extended (named) command, with
the required access control list number, or name - but with no further parameters
selected.
Software ACLs will deny access unless explicitly permitted by an ACL action.
Example 1
[creating a list]
To add a new entry to the access-list named
my-list
that will reject TCP packets
from
10.0.0.1
on TCP port
10
to
192.168.1.1
on TCP port
20
, use the
commands:
awplus# configure terminal
awplus(config)# access-list extended my-list
awplus(config-ip-ext-acl)# deny tcp 10.0.0.1/32 eq 10
192.168.1.1/32 eq 20