C
HAPTER
13
| Security Measures
Access Control Lists
– 328 –
◆ "Time Range" on page 583
COMMAND USAGE
Due to a ASIC limitation, the switch only checks the leftmost six priority
bits. This presents no problem when checking DSCP or IP Precedence bits,
but limits the checking of ToS bits (underlined in the following example) to
the leftmost three bits, ignoring the right most fourth bit.
For example, if you configured an access list to deny packets with a ToS of
7 (000011
10), the highlighted bit would be ignored, and the access list
would drop packets with a ToS of both 6 and 7.
PARAMETERS
These parameters are displayed in the web interface:
◆ Type – Selects the type of ACLs to show in the Name list.
◆ Name – Shows the names of ACLs matching the selected type.
◆ Action – An ACL can contain any combination of rules which permit or
deny a packet, or re-direct a packet to another port.
◆ Interface – The unit and port to which a packet is redirected.
(This switch does not support stacking, so the unit is fixed at 1.)
◆ Source/Destination Address Type – Specifies the source or
destination IP address. Use “Any” to include all possible addresses,
“Host” to specify a specific host address in the Address field, or “IP” to
specify a range of addresses with the Address and Subnet Mask fields.
(Options: Any, Host, IP; Default: Any)
◆ Source/Destination IP Address – Source or destination IP address.
◆ Source/Destination Subnet Mask – Subnet mask for source or
destination address. (See the description for Subnet Mask on
page 326.)
◆ Source/Destination Port – Source/destination port number for the
specified protocol type. (Range: 0-65535)
◆ Source/Destination Port Bit Mask – Decimal number representing
the port bits to match. (Range: 0-65535)
◆ Protocol – Specifies the protocol type to match as TCP, UDP or Others,
where others indicates a specific protocol number (0-255).
(Options: TCP, UDP, Others; Default: TCP)
Table 21: Priority Bits Processed by Extended IPv4 ACL
DSCP
Precedence ToS
76543210
To Next Page
Loading...
