Dell PowerConnect J-EX8208, Руководство пользователя программного обеспечения

Страница: 2821 / 3660

vlan 10;
vlan 30;
The following restrictions apply to numeric filter match conditions:
•
You cannot specify a range of values.
•
You cannot specify a list of comma-separated values.
• You cannot exclude a specific value in a numeric filter match condition. For example,
you cannot specify a condition that would match only if the match condition was not
equal to a given value.
Interface Filter Match Conditions
Interface filter match conditions can match interface name values in a packet. For
interface filter match conditions, you specify the name of the interface, for example:
[edit firewall family family-name filter filter-name term term-name from]
user@host# set interface ge-0/0/1
Port and VLAN interfaces do not use logical unit numbers. However, a firewall filter that
is applied to a router interface can specify the logical unit number in the interface filter
match condition, for example:
[edit firewall family family-name filter filter-name term term-name from]
user@host#
set interface ge-0/1/0.0
You can include the * wildcard as part of the interface name, for example:
[edit firewall family family-name filter filter-name term term-name from]
user@host# set interface ge-0/*/1
user@host#
set interface ge-0/1/*
user@host# set interface ge-*
IP Address Filter Match Conditions
Address filter match conditions can match prefix values in a packet, such as IP source
and destination prefixes. For address filter match conditions, you specify a keyword that
identifies the field and one prefix of that type that a packet must match.
You specify the address as a single prefix. A match occurs if the value of the field matches
the prefix. For example:
[edit firewall family family-name filter filter-name term term-name from]
user@host#
set destination-address 10.2.1.0/28;
Each prefix contains an implicit 0/0 except statement, which means that any prefix that
does not match the prefix that is specified is explicitly considered not to match.
To specify the address prefix, use the notation prefix/prefix-length. If you omit
prefix-length, it defaults to /32. For example:
[edit firewall family family-name filter filter-name term term-name from]
user@host#
set destination-address 10
[edit firewall family family-name filter filter-name term term-name from]
user@host# show
destination-address {
10.0.0.0/32;
}
2749
Chapter 100: Firewall Filters—Overview