Manage Device Security
359
M4100 Series Managed Switch
• Action. Specify the action to take if a packet matches the rule's criteria. The choices
are permit or deny.
• Logging. When set to Enable, logging is enabled for this ACL rule (subject to
resource availability in the device). If the Access List Trap flag is also enabled, this
causes periodic traps to be generated indicating the number of times this rule was hit
during the current report interval. A fixed 5-minute report interval is used for the entire
system. A trap is not issued if the ACL rule hit count is zero for the current interval.
This field is visible for a Deny action.
• Assign Queue ID. Specifies the hardware egress queue identifier used to handle all
packets matching this IP ACL rule. The valid range of queue IDs is 0 to 7.
• Mirror Interface. Specifies the specific egress interface where the matching traffic
stream is copied in addition to being forwarded normally by the device. This field
cannot be set if a redirect interface is already configured for the ACL rule. This field is
visible for a Permit action.
• Redirect Interface. Specifies the specific egress interface where the matching traffic
stream is forced, bypassing any forwarding decision normally performed by the
device. This field cannot be set if a mirror Interface is already configured for the ACL
rule. This field is enabled for a Permit action.
• Match Every. Select True or False. True signifies that all packets match the selected
IP ACL and rule and is either permitted or denied. In this case, since all packets
match the rule, the option of configuring other match criteria is not offered. To
configure specific match criteria for the rule, remove the rule and recreate it, or
reconfigure Match Every to False for the other match criteria to be visible.
• Protocol Type. Specify that a packet's IP protocol is a match condition for the
selected IP ACL rule. The possible values are ICMP, IGMP, IP, TCP, and UDP.
• TCP Flag. Specify that a packet's TCP flag is a match condition for the selected IP
ACL rule. The TCP flag values are URG, ACK, PSH, RST, SYN, FIN. Each TCP flag
has these possible values w and can be set separately:
• Ignore. A packet matches this ACL rule whether or not the TCP flag in this packet
is set.
• Set (+). A packet matches this ACL rule if the TCP flag in this packet is set.
• Clear (-). A packet matches this ACL rule if the TCP flag in this packet is not set.
• Source IP Address. Enter an IP address using dotted-decimal notation to be
compared to a packet's source IP address as a match criteria for the selected IP ACL
rule.
• Source IP Mask. Specify the IP Mask in dotted-decimal notation to be used with the
Source IP address value.
• Source L4 Port. Specify a packet's source Layer 4 port as a match condition for the
selected extended IP ACL rule. This is an optional configuration. The possible values
are DOMAIN, ECHO, FTP, FTPDATA, WWW-HTTP, SMTP, SNMP, TELNET, and
TFTP. Each of these values translates into its equivalent port number, which is used
as both the start and end of the port range.
To Next Page
Loading...
Need help?
General
