Access Control List Configuration
169
Software Configuration Guide, Revision 1.03
Command Purpose
Step 1
node
(pf-acl)[
name
]#permit {tcp | udp | sctp}
{
src src-wildcard
|
any
|
host
src
} [{
eq
port
|
gt
port
|
lt
port
|
range
from
to
}] {
dest dest-wildcard
|
any
|
host
dest
} [{
eq
port
|
gt
port
|
lt
port
|
range
from
to
}] [{
cos
group
|
cos-rtp
group-data
group-ctrl
}]
Creates a TCP, UDP or SCTP
access of control list entry that
permits access defined according
to the command options
Procedure
To create an TCP, UDP or SCTP access control list entry that
denies access
Mode
Profile access control list
Command Purpose
Step 1
node
(pf-acl)[
name
]#deny {tcp | udp | sctp}
{
src
src-wildcard
|
any
|
host
src
} [{
eq
port
|
gt
port
|
lt
port
|
range
from
to
}] {
dest dest-wildcard
|
any
|
host
dest
} [{
eq
port
|
gt
port
|
lt
port
|
range
from
to
}] [{
cos
group
|
cos-rtp
group-data
group-
ctrl
}]
Creates a TCP, UDP or SCTP
access of control list entry that
denies access defined according to
the command options
Where the syntax is:
Keyword
Meaning
src
The source address to be included in the rule. An IP address in dotted-decimal-
format, e.g. 64.231.1.10.
src-wildcard
A wildcard for the source address. Expressed in dotted-decimal format this value
specifies which bits are significant for matching. One-bits in the wildcard indicate
that the corresponding bits are ignored. An example for a valid wildcard is
0.0.0.255, which specifies a class C network.
any
Indicates that IP traffic to or from all IP addresses is to be included in the rule.
host src
The address of a single source host.
eq port
Optional. Indicates that a packets port must be equal to the specified port in order
to match the rule.
lt port
Optional. Indicates that a packets port must be less than the specified port in
order to match the rule.
gt port
Optional. Indicates that a packets port must be greater than the specified port in
order to match the rule
range from to Optional. Indicates that a packets port must be equal or greater than the specified
from port and less than the specified to port to match the rule.
dest
The destination address to be included in the rule. An IP address in dotted-
decimal-format, e.g. 64.231.1.10.