Manage Device Security
326
Insight Managed 28-Port Gigabit Ethernet Smart Cloud Switch with 2 SFP 1G & 2 SFP+ 10G Fiber Ports
The wildcard mask determines which bits are used and which bits are ignored. A
wildcard mask of 0.0.0.0 indicates that
none
of the bits are important. A wildcard
of 255.255.255.255 indicates that
all
of the bits are important.
•
IGMP Type
. If you specify the IGMP type, the IP ACL rule matches the specified
IGMP message type. Possible values are in the range 0 to 255. If this field is left
empty, it means
any
.
•
ICMP
. Select either the
Type
or
Message
radio button:
-
If you select the
Type
radio button, note the following:
•
The
Type
and
Code
fields are enabled only if the protocol is ICMP. Use these
fields to specify a match condition for ICMP packets:
•
The IP ACL rule matches the specified ICMP message type. Possible type
numbers are in the range from 0 to 255.
•
If you specify information in the
Message
field, the IP ACL rule matches the
specified ICMP message code. Possible values for the code can be in the
range from 0 to 255.
•
If these fields are left empty, it means
any
.
-
If you select the
Message
radio button, select the type of the ICMP message to
match with the selected IP ACL rule. Specifying a type of message implies that
both the ICMP type and ICMP code are specified. The ICMP message is decoded
into the corresponding ICMP type and ICMP code within the ICMP type.
The IPv4 ICMP message types are
echo
,
echo-reply
,
host-redirect
,
mobile-redirect
,
net-redirect
,
net-unreachable
,
redirect
,
packet-too-big
,
port-unreachable
,
source-quench
,
router-solicitation
,
router-advertisement
,
ttl-exceeded
,
time-exceeded
, and
unreachable
.
•
Fragments
. Either select the
Enable
radio button to allow initial fragments (that is,
the fragment bit is asserted) or leave the default
Disable
radio button selected to
prevent initial fragments from being used.
This option is not valid for rules that match L4 information such as a TCP port number,
because that information is carried in the initial packet.
•
Service Type
. Select a service type match condition for the extended IP ACL rule.
The possible options are
IP DSCP
,
IP precedence
, and
IP TOS
, which are alternative
methods to specify a match criterion for the same service type field in the IP header.
Each method uses a different user notation. After you make a selection, you can
specify the appropriate values:
-
IP DSCP
. This is an optional configuration. Specify the IP DiffServ Code Point
(DSCP) field. The DSCP is defined as the high-order 6 bits of the service type
octet in the IP header. Enter an integer from 0 to 63. To select the IP DSCP, select
one of the DSCP keywords from the menu. To specify a numeric value, select
Other
and a field displays in which you can enter numeric value of the DSCP.
-
IP Precedence
. This is an optional configuration. The IP precedence field in a
packet is defined as the high-order 3 bits of the service type octet in the IP header.
Enter an integer from 0 to 7.
