Patton electronics SmartNode Series Software Configuration Manual page 256

SmartWare Software Configuration Guide
Mode: Profile access control list
Step
1 node(pf-acl)[name]#deny ip {src src-wildcard | any | host
src} {dest dest-wildcard | any | host dest} [cos group]
Where the syntax is:
Keyword Meaning
src The source address to be included in the rule. An IP address in dotted-decimal-format,
e.g. 64.231.1.10.
src-wildcard A wildcard for the source address. Expressed in dotted-decimal format this value specifies
which bits are significant for matching. One-bits in the wildcard indicate that the corre-
sponding bits are ignored. An example for a valid wildcard is 0.0.0.255, which speci-
fies a class C network.
any Indicates that IP traffic to or from all IP addresses is to be included in the rule.
host src The address of a single source host.
dest The destination address to be included in the rule. An IP address in dotted-decimal-for-
mat, e.g. 64.231.1.10.
dest-wildcard A wildcard for the destination address. See src-wildcard
host dest The address of a single destination host.
cos Optional. Specifies that packets matched by this rule belong to a certain Class of Service
(CoS). For detailed description of CoS configuration refer to chapter 13,
configuration"
group CoS group name.
If you place a deny ip any any rule at the top of an access control list profile, no packets will pass regardless of
the other rules you defined.
Example: Create IP access control list entries
Select the access-list profile named WanRx and create some filter rules for it.
node(cfg)#profile acl WanRx
node(pf-acl)[WanRx]#permit ip host 62.1.2.3 host 193.14.2.11 cos Urgent
node(pf-acl)[WanRx]#permit ip 62.1.2.3 0.0.255.255 host 193.14.2.11
node(pf-acl)[WanRx]#permit ip 97.123.111.0 0.0.0.255 host 193.14.2.11
node(pf-acl)[WanRx]#deny ip any any
node(pf-acl)[WanRx]#exit
node(cfg)#
Access control list configuration task list
Command
on page 149.
24 • Access control list configuration
Purpose
Creates an IP access of control list
entry that denies access defined
according to the command
options
"Link scheduler
256