Creating Policy Conditions For Acls; Creating Policy Actions For Acls - Alcatel OmniSwitch 6800 Series Network Configuration Manual

Configuring ACLs

Creating Policy Conditions For ACLs

A policy condition for IP filtering may include a particular source IP address, destination IP address,
source IP port, or destination IP port. Or, the condition may simply refer to the network group, MAC
group, port group, or service group. Typically ACLs use group keywords in policy conditions. A single
rule, therefore, filters traffic for multiple addresses or ports.
For example:
-> policy port group pgroup1 3/1-2 4/3 5/4
-> policy condition c2 source port group pgroup1
In this example, a Layer 2 condition (c2) specifies that traffic matches the ports included of the pgroup1
port group. The condition also specifies that the port group is a source group. Any traffic coming in on
ports 1 or 2 on slot 3, port 3 on slot 4, or port 4 on slot 5 will match condition c2.
For more information about condition groups, see
The following table lists the keywords for the policy condition command that are typically used for the
different types of ACLs:
Layer 2 ACL Condition
Keywords
source mac
source mac group
destination mac
destination mac group
source vlan
source port
source port group
destination port
destination port group
ethertype
Note that the individual address, service, or port cannot be used in conjunction with the same type of
condition group. For example, you cannot specify in the same rule both a source MAC address and a
source MAC group.

Creating Policy Actions For ACLs

A policy action for IP filtering specifies a disposition, that is, whether the flow is accepted or denied on
the switch. To create a policy action, use the policy action command. Use the disposition keyword to
define whether the flow is accepted (accept) or denied (deny). For example:
-> policy action a1 disposition accept
If you do not specify a disposition for the policy action, the default (accept) will be used.
OmniSwitch 6800 Series Network Configuration Guide
"Creating Condition Groups For ACLs" on page
Layer 3/4 ACL Condition
Keywords
source ip
source network group
destination ip
destination network group
source ip port
destination ip port
service
service group
ip protocol
destination port
destination port group
icmptype
icmpcode
November 2004
Configuring ACLs
Multicast ACL Condition
Keywords
multicast ip
multicast network group
destination ip
destination vlan
destination port
destination port group
destination mac
destination mac group
22-8.
page 22-9