Adding An Access Profile Entry - Extreme Networks ExtremeWare 7.2e Installation And User Manual

Security

Adding an Access Profile Entry

Next, configure the access profile, using the following command:
configure access-profile <access profile> add {<seq_number>} {permit | deny}
[ipaddress <ip address> <mask> {exact} | as-path <path-expression> | ipxnet <netid>
<netid mask> | ipxsap <sap_type> <service_name> | vlan]
The following sections describe the
Specifying Subnet Masks
The subnet mask specified in the access profile command is interpreted as a reverse mask. A reverse
mask indicates the bits that are significant in the IP address. In other words, a reverse mask specifies the
part of the address that must match the IP address to which the profile is applied.
If you configure an IP address that is an exact match that is specifically denied or permitted, use a mask
of /32 (for example, 141.251.24.28/32). If the IP address represents all addresses in a subnet address that
you want to deny or permit, then configure the mask to cover only the subnet portion (for example,
141.251.10.0/24). The keyword
address, and ignore all addresses within the subnet.
If you are using off-byte boundary subnet masking, the same logic applies, but the configuration is
more tricky. For example, the network address 141.251.24.128/27 represents any host from subnet
141.251.24.128.
Sequence Numbering
You can specify the sequence number for each access profile entry. If you do not specify a sequence
number, entries are sequenced in the order they are added. Each entry is assigned a value of 5 more
than the sequence number of the last entry.
Permit and Deny Entries
If you have configured the access profile mode to be
'permit' or 'deny'. If you do not specify the entry type, it is added as a permit entry. If you have
configured the access profile mode to be
entry.
Autonomous System Expressions
The keyword uses a regular expression string to match against the AS path. Regular expression
AS-path
notation can include any of the characters listed in Table 32.
Table 32: Regular Expression Notation
Character Definition
N As number
N - N Range of AS numbers, where N
1 2
[N ... N ] Group of AS numbers, where N
x y
[^N ... N ] Any AS numbers other than the ones in the group
x y
. Matches any number
162
configure access-profile add
can be used when you wish to match only against the subnet
exact
none
or
permit deny
and N are AS numbers and N
1 2
and N are AS numbers or a range of AS numbers
x y
command.
, you must specify each entry type as either
, it is not necessary to specify a type for each
< N
1 2
ExtremeWare 7.2e Installation and User Guide