HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 479 / 778

10-59
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Configuring Extended ACLs
Command Summary for Extended ACLs
Action Command(s) Page
Create an Extended,
Named ACL
or
Add an ACE to the End
of an Existing,
Extended ACL
HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-std-nacl)# < deny | permit >
< ip | ip-protocol | ip-protocol-nbr >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
10-61
[ tcp | udp ]
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
[ comparison - operator < value >] ]
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ comparison - operator < value >]
[established]
[ack] [fin] [rst] [syn]
2
10-61
< igmp >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ igmp-packet-type ]
10-61
< icmp >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ [< 0 - 255 > [ 0 - 255 ] ] | icmp-message ]
10-61
[precedence < priority >]
[tos < tos- setting >]
[log]
2
10-61
Create an Extended,
Numbered ACL
or
Add an ACE to the End
of an Existing,
Numbered ACL
HP Switch(config)# access-list < 100-199 > < deny | permit >
< ip-options | tcp/udp-options | igmp-options | icmp-options >
[log]
2
[precedence < priority >]
[tos < tos- setting >]
Note:
Uses the same IPv4, TCP/UDP, IGMP, and ICMP options as shown above for
“Create an Extended, Named ACL”.
10-74
Insert an ACE by
Assigning a Sequence
Number HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-ext-nacl)# 1-2147483647 < deny | permit >
Uses the options shown above for “Create an Extended, Named ACL”.
10-88
1
The mask can be in either dotted-decimal notation (such as 0.0.15.255) or CIDR notation (such as /20).
2
TCP flag (control bit) options for destination TCP.
3
The [ log ] function applies only to “deny” ACLs, and generates a message only when there is a “deny” match.
Table continues on next page.