Enterasys X-Pedition XSR CLI Cli Reference Manual page 668

Firewall Feature Set Commands
Syntax
ip firewall policy policy_name src_net_name dst_net_name serv_name {allow | allow-
log | allow-auth group_name | reject | log | url-b | url-w | cls name ...
name}[before policy_name | after policy_name | first] [bidirectional]
src_net_name
dst_net_name
serv_name
allow
allow-log
allow-auth
group_name
reject
log
url-b | url-w
cls name
before or after
policy_name
first
bidirectional
Syntax of the "no" Form
The no form of this command disables an earlier configured policy:
no ip firewall policy policy_name
Defaults
Deny all
Mode
Global configuration:
16-124 Configuring Security
Name of source network object, not to exceed 16 characters. This value must
match network
Name of destination network object, not to exceed 16 characters. This value
must match
Name of service object, not to exceed 16 characters.
Let packets pass through the firewall.
Let packets through the firewall and log the activity.
Let packets pass if the source IP address has been authenticated against the
group_name (length not to exceed 16 characters). This value must match
network-group
Drop all packets matching the policy.
Drop all matching packets and log the activity.
Filters HTTP traffic (TCP connection with a destination port of 80 or 8080)
using the black (url‐b) URL list.
Filters http traffic using the white (url‐w) URL list. HTTP access to URLs
matching an entry in the white URL list are allowed, non‐matching URLs
are blocked.
Let packets pass through the firewall if the application message type
matches one of the 10 type names. Names must not exceed 16 characters.
Place policy before or after the policy cited by policy_name (which must
already have been set). If not specified, the object will be the last listed.
Place policy first.
Policy applies in both directions. That is, for a session initiated at the source
as well as the destination.
Note: If the action is allow-auth the group_name must be specified. All users who are members of
this group are allowed authenticated access. Also, be sure to match the group_name and AAA
group name.
XSR(config)#
name exactly.
network
name exactly.
name exactly.