3-23
Virus Throttling (Connection-Rate Filtering)
Configuring and Applying Connection-Rate ACLs
ip-addr < mask-length >: Applies the ACEs action (filter
or ignore) to IP traffic having an SA within the range
defined by either:
< src-ip-addr/cidr-mask-bits>
or
<src-ip-addr < mask >>
Use this criterion for traffic received from either a
subnet or a group of IP addresses. The mask can be in
either dotted-decimal format or CIDR format with the
number of significant bits. Refer to “Using CIDR
Notation To Enter the ACE Mask” on page 3-25.
[ udp/tcp-options ]
destination-port < tcp-data > [source-port < tcp-data >]
source-port < tcp-data > [destination-port < tcp-data >]
destination-port < udp-data > [source-port < udp-data >]
source-port < udp-data > [destination-port < udp-data >]
tcp-data: < operator > < tcp-port-# >
udp-data: < operator > < udp-port-# >
operator: < eq | gt | lt | neq | range >
eq < port-nbr-or-name >: “Equal To”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must be equal
to the specified port number.
gt: < port-nbr-or-name >: “Greater Than”; to have
a match with the ACE entry, the TCP or UDP
source-port number in a packet must be
greater than the specified port number.
lt < port-nbr-or-name >: “Less Than”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must be less
than the specified port number.
neq < port-nbr-or-name >: “Not Equal”; to have a
match with the ACE entry, the TCP or UDP
source-port number in a packet must not be
equal to the specified port number.
range < start-port-nbr /name > < end-port-nbr/name
>: To have a match with the ACE entry, the TCP
or UDP source-port number in a packet must
be in the range < start-port-nbr /name > < end-
port-nbr/name >.
To Next Page
Loading...
Need help?
General