Edge-Core ECS4110-28T Management Manual page 362

| Security Measures
C 13
HAPTER
Access Control Lists
Control Code Bit Mask – Decimal number representing the code bits
◆
to match. (Range: 0-63)
The control bit mask is a decimal number (for an equivalent binary bit
mask) that is applied to the control code. Enter a decimal number,
where the equivalent binary bit "1" means to match a bit and "0"
means to ignore a bit. The following bits may be specified:
1 (fin) – Finish
■
2 (syn) – Synchronize
■
4 (rst) – Reset
■
8 (psh) – Push
■
16 (ack) – Acknowledgement
■
32 (urg) – Urgent pointer
■
For example, use the code value and mask below to catch packets with
the following flags set:
SYN flag valid, use control-code 2, control bit mask 2
■
Both SYN and ACK valid, use control-code 18, control bit mask 18
■
SYN valid and ACK invalid, use control-code 2, control bit mask 18
■
Time Range – Name of a time range.
◆
W I
EB NTERFACE
To add rules to an IPv4 Extended ACL:
Click Security, ACL.
1.
Select Configure ACL from the Step list.
2.
Select Add Rule from the Action list.
3.
Select IP Extended from the Type list.
4.
Select the name of an ACL from the Name list.
5.
Specify the action (i.e., Permit or Deny).
6.
Select the address type (Any, Host, or IP).
7.
If you select "Host," enter a specific address. If you select "IP," enter a
8.
subnet address and the mask for an address range.
Set any other required criteria, such as service type, protocol type, or
9.
control code.
Click Apply.
10.
– 362 –