Alcatel OmniSwitch 6600 Family Network Configuration Manual page 552

Using ACL Security Features
2
Add the services created in Step 1 to a service group called DropServices using the
group command. For example:
-> policy service group DropServices tcp135 tcp445 udp137 udp138 udp445
Note that the DropServices group must be specified using the exact capitalization as shown in the
above example.
3
Create a condition with the DropServices group defined in Step 2 and a source port group using the
policy port group and
-> policy port group badGuyPorts 5/1 6/1
-> policy condition badGuys source port group badGuyPorts service group DropServices
4 Create a condition with the DropServices group defined in Step 2 and a source VLAN. For example:
-> policy condition goodGuys source vlan 20 service group DropServices
5
Create a drop action and an accept action using the
-> policy action DROP disposition drop
-> policy action ACCEPT disposition accept
6
Create a deny rule for the source ports and an accept rule for the source VLAN using the
command. For example:
-> policy rule r1 condition badGuys action DROP
-> policy rule r2 condition goodGuys action ACCEPT
7
Apply the ACL configuration using the
-> qos apply
The resulting ACL will drop traffic received on the specified source ports that is destined for service ports
identified in the DropServices group, while at the same time allowing traffic originating on VLAN 20 to
use these same services. The following shows what this ACL looks like in its entirety:
-> policy service tcp135 destination tcp port 135
-> policy service tcp445 destination tcp port 445
-> policy service udp137 destination udp port 137
-> policy service udp138 destination udp port 138
-> policy service udp445 destination udp port 445
-> policy service group DropServices tcp135 tcp445 udp137 udp138 udp445
-> policy port group badGuyPorts 5/1 6/1
-> policy condition badGuys source port group badGuyPorts service group DropServices
-> policy action DROP disposition drop
-> policy action ACCEPT disposition accept
-> policy rule r1 condition badGuys action DROP
-> policy rule r2 condition goodGuys action ACCEPT
-> qos apply
page 25-20
policy condition commands. For example:
qos apply
OmniSwitch 6600 Family Network Configuration Guide
policy action disposition
command.
Configuring ACLs
policy service
command. For example:
policy rule
April 2006