Alcatel-Lucent 7450 - Page 131

Security
7450 ESS System Mangement Guide Page 131
If the packet does not meet any of the match criteria the configured default action is applied.
Default none — The action is specified by default-action command.
Parameters permit — Specifies that packets matching the configured criteria will be permitted.
deny — Specifies that packets matching the configured selection criteria will be denied and that a
ICMP host unreachable message will not be issued.
deny-host-unreachable — Specifies that packets matching the configured selection criteria will be
denied and that a host unreachable message will not be issued.
Note: deni-host-unreachable only applies to ip-filter and ipv6filter.
default-action
Syntax default-action {permit | deny | deny-host-unreachable}
Context config>system>security>mgmt-access-filter>ip-filter
config>system>security>mgmt-access-filter>mac-filter
Description This command creates the default action for management access in the absence of a specific manage-
ment access filter match.
The default-action is applied to a packet that does not satisfy any match criteria in any of the man-
agement access filters. Whenever management access filters are configured, the default-action must
be defined.
Default No default-action is defined.
Parameters permit — Specifies that packets not matching the configured selection criteria in any of the filter
entries will be permitted.
deny — Specifies that packets not matching the selection criteria be denied and that an ICMP host
unreachable message will not be issued.
deny-host-unreachable — Specifies that packets not matching the selection criteria be denied access
and that an ICMP host unreachable message will be issued. Note: deni-host-unreachable only
applies to ip-filter and ipv6filter.
dst-port
Syntax [no] dst-port value [mask]
Context config>system>security>mgmt-access-filter>entry
Description This command configures a source TCP or UDP port number or port range for a management access
filter match criterion.
The no form of the command removes the source port match criterion.
Default No dst-port match criterion.