Setting A Source Ip Acl - Nortel 2300 Series Configuration Manual

354 Configuring and Managing Security ACLs

Setting a Source IP ACL

You can create an ACE that filters packets based on the source IP address and optionally applies CoS packet handling.
(For CoS details, see "Class of Service" on page
ACL by using the before editbuffer-index or modify editbuffer-index variables with an index number. You can use the
hits counter to track how many packets the ACL filters.
The simplest security ACL permits or denies packets from a source IP address:
set security acl ip acl-name {permit [cos cos] | deny} source-ip-addr mask [before
editbuffer-index | modify editbuffer-index]
For example, to create ACL acl-1 that permits all packets from IP address 192.168.1.4, type the following command:
23x0# set security acl ip acl-1 permit 192.168.1.4 0.0.0.0
With the following basic security ACL command, you can specify any of the protocols supported by WSS Software:
set security acl ip acl-name {permit [cos cos] | deny} {protocol} {source-ip-addr mask
destination-ip-addr mask} [precedence precedence] [tos tos] [before editbuffer-index
| modify editbuffer-index]
The following sample security ACL permits all Generic Routing Encapsulation (GRE) packets from source IP address
192.168.1.11 to destination IP address 192.168.1.15, with a precedence level of 0 (routine), and a type-of-service (TOS)
level of 0 (normal). (For more information about type-of-service and precedence levels, see the Nortel Mobility System
Software Command Reference.) GRE is protocol number 47.
23x0# set security acl ip acl-2 permit cos 2 47 192.168.1.11 0.0.0.0 192.168.1.15 0.0.0.0
precedence 0 tos 0 hits
The security ACL acl-2 described above also applies the CoS level 2 (medium priority) to the permitted packets. (For
CoS details, see "Class of Service" on page
traffic.
Table 22 lists common IP protocol numbers. (For a complete list of IP protocol names and numbers, see
http://www.iana.org/assignments/protocol-numbers.) For commands that set security ACLs for specific protocols, see
the following information:
• "Setting an ICMP ACL" on page 357
• "Setting a TCP ACL" on page 359
• "Setting a UDP ACL" on page 359
Table 22: Common IP Protocol Numbers
Number
1
2
6
9
320657-A
355.) You can also determine where the ACE is placed in the security
355.) The keyword hits counts the number of times this ACL affects packet
IP Protocol
Internet Message Control Protocol (ICMP)
Internet Group Management Protocol (IGMP)
Transmission Control Protocol (TCP)
Any private interior gateway (used by Cisco for Internet Gateway Routing
Protocol)