Extreme Networks ExtremeWare 7.2e, Инструкция по установке и эксплуатации

Страница: 162 / 344

162 ExtremeWare 7.2e Installation and User Guide
Security
Adding an Access Profile Entry
Next, configure the access profile, using the following command:
configure access-profile <access profile> add {<seq_number>} {permit | deny}
[ipaddress <ip address> <mask> {exact} | as-path <path-expression> | ipxnet <netid>
<netid mask> | ipxsap <sap_type> <service_name> | vlan]
The following sections describe the
configure access-profile add
command.
Specifying Subnet Masks
The subnet mask specified in the access profile command is interpreted as a reverse mask. A reverse
mask indicates the bits that are significant in the IP address. In other words, a reverse mask specifies the
part of the address that must match the IP address to which the profile is applied.
If you configure an IP address that is an exact match that is specifically denied or permitted, use a mask
of /32 (for example, 141.251.24.28/32). If the IP address represents all addresses in a subnet address that
you want to deny or permit, then configure the mask to cover only the subnet portion (for example,
141.251.10.0/24). The keyword
exact
can be used when you wish to match only against the subnet
address, and ignore all addresses within the subnet.
If you are using off-byte boundary subnet masking, the same logic applies, but the configuration is
more tricky. For example, the network address 141.251.24.128/27 represents any host from subnet
141.251.24.128.
Sequence Numbering
You can specify the sequence number for each access profile entry. If you do not specify a sequence
number, entries are sequenced in the order they are added. Each entry is assigned a value of 5 more
than the sequence number of the last entry.
Permit and Deny Entries
If you have configured the access profile mode to be
none
, you must specify each entry type as either
‘permit’ or ‘deny’. If you do not specify the entry type, it is added as a permit entry. If you have
configured the access profile mode to be
permit
or
deny
, it is not necessary to specify a type for each
entry.
Autonomous System Expressions
The
AS-path
keyword uses a regular expression string to match against the AS path. Regular expression
notation can include any of the characters listed in Table 32.
Table 32: Regular Expression Notation
Character Definition
N As number
N
1
- N
2
Range of AS numbers, where N
1
and N
2
are AS numbers and N
1
< N
2
[N
x
... N
y
] Group of AS numbers, where N
x
and N
y
are AS numbers or a range of AS numbers
[^N
x
... N
y
] Any AS numbers other than the ones in the group
. Matches any number