Eion LibraPlus 5845, Руководство пользователя, Страница: 96 / 140

• protocol type, which can be one of icmp , tcp or udp .
• state of the connection, which can be new , established or related . LibraPlus implements stateful
packet inspection, i.e. it tracks packets in the context of preceding communication between the same
source and destination. State keywords may be combined in the same ACL entry using "
, " as a
separator.
On this basis, the ACL command has the following format:
access-list { id } {permit | deny} [ protocol ] { source } { destination } [state state ]
Passing packets are compared to ACL entries based on the order that the entries occur in the list. New
statements are added to the end. When a matching entry is found, the
permit or deny action is imme-
diately applied to the packet. For this reason, you should have frequently hit entries at the top of the
list. In addition, the last ACL entry should be the default policy that blocks or transmits all the previously
unmatched packets.
4.8.1.1. Source and Destination Specifiers
Each ACL entry can match a single host address, or a group of addresses. In the case of a single host,
use the
host keyword followed by an IP address. A group of addresses can be described using an IP
address and a wildcard, where wildcard is an inverse network mask.
After that, source and destination can be described more precisely using a TCP/UDP port number with
a comparison operator:
• eq for "equal",
• neq for "not equal",
• lt for "less than" and
• gt for "greater than".
Finally, the keyword any is used to match any IP address and port.
Format Type
host
{
ip-address
} [eq | neq | lt | gt
port
] Single address
{ ip-address } { wildcard } [{eq | neq | lt | gt} port ] Address group
any
Any address and port
Table 4.2. Source and Destination Specifiers
4.8.1.2. Access list binding
ACL should be associated with a network interface in order to take effect. The
interface access-
group [86]
binds the ACL to the incoming or outgoing direction of a network interface:
interface
{
name
} {
index
}
access-group
{
acl-id
} {in | out}
Example 4.68. Deny everything
access-list 100 deny any any
interface FastEthernet 0 access-group 100 in
interface Wireless 0 access-group 100 in
86
Configuration