Hitachi GX1000-SMC013X, Инструкция по эксплуатации

Страница: 121 / 452

121
deny (advance access-list)
Specifies the conditions by which the Advance filter denies access.
Input format
To set or change information:
[
<sequence>
] deny mac {
filter-condition
}[
action-specification
]
[
<sequence>
] deny mac-ip {
filter-condition
}[
action-specification
]
[
<sequence>
] deny mac-ipv6 {
filter-condition
}[
action-specification
]
filter-condition
For
mac {
filter-condition
}
:
This filter condition is used to perform flow detection based on MAC header
conditions.
mac {
<source mac> <source mac mask>
| host
<source mac>
| any}
{
<destination mac> <destination mac mask>
| host
<destination mac>
| any
| bpdu | cdp | lacp | lldp | oadp | pvst-plus-bpdu | slow-protocol}
[
<ethernet type>
][vlan {
<vlan id>
|
<vlan id list name>
}] [user-priority
<priority>
][{ctag-untagged | [ctag-user-priority
<priority>
]
[ctag-vlan
<vlan id>
]}]
For
mac-ip {
filter-condition
}
:
This filter condition is used to perform flow detection based on MAC header
conditions, IPv4 header conditions, or Layer 4 header conditions.
-
When "packet is not fragmented" is a condition, and the upper-layer
protocol is other than TCP, UDP, ICMP, and IGMP
mac-ip {
<source mac> <source mac mask>
| host
<source mac>
|
any} {
<destination mac> <destination mac mask>
| host
<destination
mac>
| any | bpdu | cdp | lacp | lldp | oadp | pvst-plus-bpdu
| slow-protocol} {ip |
<protocol>
} {{
<source ipv4>
|
own-address}
<source ipv4 wildcard>
| host {
<source ipv4>
|
own-address} | any | own | range-address
<source ipv4 start>
<source ipv4 end>
} {{
<destination ipv4>
| own-address}
<destination ipv4 wildcard>
| host {
<destination ipv4>
|
own-address} | any | own | range-address
<destination ipv4 start>
<destination ipv4 end>
} [{[tos
<tos>
] [precedence
<precedence>
]
| dscp
<dscp>
}] [vlan {
<vlan id>
|
<vlan id list name>
}]
[user-priority
<priority>
][{ctag-untagged |
[ctag-user-priority
<priority>
] [ctag-vlan
<vlan id>
]}]
- When "packet is not fragmented" is a condition, and the upper-layer
protocol is TCP
mac-ip {
<source mac> <source mac mask>
| host
<source mac>
|
any} {
<destination mac> <destination mac mask>
| host
<destination
mac>
| any | bpdu | cdp | lacp | lldp | oadp | pvst-plus-bpdu
| slow-protocol} tcp {{
<source ipv4>
| own-address}
<source
ipv4 wildcard>
| host {
<source ipv4>
| own-address} | any | own
| range-address
<source ipv4 start> <source ipv4 end>
} [{{eq |
neq}
<source port>
| range
<source port start> <source port end>
}]
{{
<destination ipv4>
| own-address}
<destination ipv4 wildcard>
|
host {
<destination ipv4>
| own-address} | any | own |
range-address
<destination ipv4 start> <destination ipv4 end>
}
[{{eq | neq}
<destination port>
| range
<destination port start>
<destination port end>
}] [{[established] | [{ack | +ack | -ack}]
[{fin | +fin | -fin}] [{psh | +psh | -psh}] [{rst | +rst |
-rst}] [{syn | +syn | -syn}] [{urg | +urg | -urg}]}] [{[tos