HP J8697A, Руководство по обеспечению безопасности доступа

Страница: 80 / 390

Virus Throttling
Configuring and Applying Connection-Rate ACLs
ip-addr < mask-length >: Applies the ACEs action ( filter
or ignore ) to IP traffic having an SA within the range
defined by either:
< src-ip-addr / cidr-mask-bits >
or
< src-ip-addr < mask >>
Use this criterion for traffic received from either a
subnet or a group of IP addresses. The mask can be in
either dotted-decimal format or CIDR format with the
number of significant bits. Refer to “Using CIDR
Notation To Enter the ACE Mask” on page 3-26.
[ udp/tcp - options ]
destination-port < tcp-data > [source-port < tcp-data >]
source-port < tcp-data > [destination-port < tcp-data >]
destination-port < udp-data > [source-port < udp-data >]
source-port < udp-data > [destination-port < udp-data >]
tcp-data: < operator > < tcp-port-# >
udp-data: < operator > < udp-port-# >
operator : < eq | gt | lt | neq | range >
eq < port-nbr-or-name >:
“Equal To”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must be equal
to the specified port number.
gt: < port-nbr-or-name >:
“Greater Than”; to have
a match with the ACE entry, the TCP or UDP
source-port number in a packet must be
greater than the specified port number.
lt < port-nbr-or-name >:
“Less Than”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must be less
than the specified port number.
neq < port-nbr-or-name >:
“Not Equal”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must not be
equal to the specified port number.
range < start-port-nbr /name > < end-port-nbr/name
>:
To have a match with the ACE entry, the TCP
or UDP source-port number in a packet must
be in the range
< start-port-nbr /name > < end­
port-nbr/name >
.
3-24