InfiNet R5000 series, Руководство пользователя

Страница: 63 / 122

Chapter 2 - Features set
User Manual
R5000 series - Web GUI
54
CAUTION
A packet that cannot be associated with any switching group will not switched by the
device. If there is no group with appropriate rules for the packet, it will be discarded.
When the packet is assigned to a switching group, the group decides whether
the packet to be sent through one of the interfaces, or to discard it. The packet
will only be sent if it satisfies the rules of this interface.
The rules consist of a "rules list" and a decision (deny/permit). While parsing the list,
the switch checks whether a packet matches the rule. If it matches the rule, the
decision set for this rule is applied to the packet. Otherwise, the list of rules is viewed
further. Rules are taken one at a time. If a packet does not match to any rule, the
default decision for this group or interface is taken.
The expression selects which packets will fit into the group. Only the packets for
which the expression is
“true” will be matched to the group. The expression consists
of one or more primitives. Primitives usually consist of an id (name or number)
preceded by one or more qualifiers.
Examples packet filter rules:
Single IP subnet:
net 192.168.1.0/24
Several IP subnets:
net 192.168.1.0/24 or net 192.168.100.0/24
Several IP subnets with exceptions:
net 192.168.1.0/16 and not net (192.168.100.0/24 or
192.168.200.0/24)
Several IP subnets inside VLAN:
vlan 50 and (net 192.168.1.0/24 or net 192.168.100.0/24)
PPPoE traffic:
pppoed or pppoes
which is synonym to:
ether proto 0x8863 or ether proto 0x8864
Disable IP multicast and broadcast:
not ip multicast