Table of Contents
Advertisement
Chapter 13: Access Control List Configuration Guide
When the rate limit definition is applied to an interface (with the rate-limit apply
interface command), packets in flows originating from source address 1.2.2.2 are dropped
if their bandwidth usage exceeds 10 Mbps.
See
"Limiting Traffic Rate" on page 241
command.
Using Profile ACLs with Dynamic NAT
Network Address Translation (NAT) allows you to map an IP address used within one
network to a different IP address used within another network. NAT is often used to map
addresses used in a private, local intranet to one or more addresses used in the public,
global Internet.
The IA supports two kinds of NAT: static NAT and dynamic NAT. With dynamic NAT, an IP
address within a range of local IP addresses is mapped to an IP address within a range of
global IP addresses. For example, you can configure IP addresses on network 10.1.1.0/24
to use an IP address in the range of IP addresses in network 192.50.20.0/24. You can use a
Profile ACL to define the ranges of local IP addresses.
The following command creates a Profile ACL called local. The local profile specifies as its
selection criteria the range of IP addresses in network 10.1.1.0/24.
ia(config)# acl local permit ip 10.1.1.0/24
Note:
When a Profile ACL is defined for dynamic NAT, only the source IP address field
in the acl statement is evaluated. All other fields in the acl statement are ignored.
Once you have defined a Profile ACL, you can then use the nat create dynamic command
to bind the range of IP addresses defined in the local profile to a range in network
192.50.20.0/24.
ia(config)# nat create dynamic local-acl-pool local global-pool 192.50.20.10/24
See
Chapter 11, "Network Address Translation Configuration Guide,"
information on using dynamic NAT.
Using Profile ACLs with the Port Mirroring Facility
Port mirroring refers to the IA's ability to copy traffic on one or more ports to a mirror
port, where an external analyzer or probe can be attached. In addition to mirroring traffic
on one or more ports, the IA can mirror traffic that matches selection criteria defined in a
Profile ACL.
222
for more information on using the rate-limit
Internet Appliance User Reference Manual
for more
Advertisement
Table of Contents
