3Com CoreBuilder 7000 Operation Manual page 163

have the join privilege, the LES prevents the LEC from joining the ELAN by
sending it an ACCESS_DENIED response code.
Best Match Verification—Admitting Individual LECs in a Group
The entry in an ELAN security table with the best (longest) match with a
candidate LEC address determines the LEC's right to join the ELAN. This
method of verifying allows you to lock out a group of LECs in a network
segment by assigning REJECT to their network prefix and, at the same
time, to admit individual LECs in the same group by assigning ACCEPT to
their complete ATM addresses. Alternatively, you can admit a group of
LECs while locking out individual LECs in the group.
In any case, you need to take the ELAN default join privilege into account
for LECs whose addresses don't appear in the security table.
Example
In the following ELAN security table, the group of LECs with network
prefix 47.0.0.0.0.0.3c.0.0.a0.* is locked out while one member of that
group with ATM address 47.0.0.0.0.0.3c.0.0.a0.0.0.0.0.c0.da.3d.ad.51.0
is admitted:
Table Entry Address
1 47.0.0.0.0.0.3c.0.0.a0.*
2 47.0.0.0.0.0.3c.0.0.a0.0.0.0.0.c0.da.3d.ad.51.0
And the ELAN default join privilege is REJECT.
Suppose the following LECs request to join the ELAN:
LEC Name Address
LEC 1 47.0.0.0.0.0.3c.0.0.a0.0.0.0.0.c0.da.3d.ad.31.0
LEC 2 47.0.0.0.0.0.3c.0.0.a0.0.0.0.0.c0.da.3d.ad.51.0
LEC 3 67.0.0.0. ...
LEC 4 47.0.0.0.1.0.0....
The results of the security check will be as follows:


LEC 1 is rejected because the first entry in the table, the network
prefix, contains the best match — with join privilege REJECT.


LEC 2 is admitted because the second entry, the full ATM address, is
the best match — with join privilege ACCEPT.
LANE Security 163
Join Privilege
REJECT
ACCEPT