Cisco Cisco ASR 5500 Administrator's Guide
Diameter Dictionaries and Attribute Definitions
Diameter Attributes ▀
Cisco ASR 5x00 AAA Interface Administration and Reference ▄
51
Rules for the appropriate direction are evaluated in order, with the first matched rule terminating the evaluation. Each
packet is evaluated once. If no rule matches, the packet is dropped if the last rule evaluated was a permit, and passed if
the last rule was a deny.
packet is evaluated once. If no rule matches, the packet is dropped if the last rule evaluated was a permit, and passed if
the last rule was a deny.
IPFilterRule filters MUST follow the format:
action dir proto from src to dst [options]
Table 4. IPFilterRule Field Description
Field
Description
action
This field can be set to one of the following:
permit – Allow packets that match the rule.
deny – Drop packets that match the rule.
dir
"in" is from the terminal and "out" is to the terminal.
proto
An IP protocol specified by number. The "ip" keyword means any protocol will match.
src and
dst
dst
<address/mask> [ports]
The <address/mask> may be specified as:
ipno — An IPv4 or IPv6 number in dotted-quad or canonical IPv6 form. Only this exact IP number will match the rule.
ipno/bits — An IP number as above with a mask width of the form 1.2.3.4/24. In this case, all IP numbers from 1.2.3.0
to 1.2.3.255 will match. The bit width MUST be valid for the IP version and the IP number MUST NOT have bits set
beyond the mask. For a match to occur, the same IP version must be present in the packet that was used in describing
the IP address. To test for a particular IP version, the bits part can be set to zero. The keyword "any" is 0.0.0.0/0 or the
IPv6 equivalent. The keyword "assigned" is the address or set of addresses assigned to the terminal. For IPv4, a typical
first rule is often "deny in ip! assigned"
The sense of the match can be inverted by preceding an address with the not modifier (!), causing all other addresses to
be matched instead. This does not affect the selection of port numbers.
With the TCP, UDP and SCTP protocols, optional ports may be specified as:
The <address/mask> may be specified as:
ipno — An IPv4 or IPv6 number in dotted-quad or canonical IPv6 form. Only this exact IP number will match the rule.
ipno/bits — An IP number as above with a mask width of the form 1.2.3.4/24. In this case, all IP numbers from 1.2.3.0
to 1.2.3.255 will match. The bit width MUST be valid for the IP version and the IP number MUST NOT have bits set
beyond the mask. For a match to occur, the same IP version must be present in the packet that was used in describing
the IP address. To test for a particular IP version, the bits part can be set to zero. The keyword "any" is 0.0.0.0/0 or the
IPv6 equivalent. The keyword "assigned" is the address or set of addresses assigned to the terminal. For IPv4, a typical
first rule is often "deny in ip! assigned"
The sense of the match can be inverted by preceding an address with the not modifier (!), causing all other addresses to
be matched instead. This does not affect the selection of port numbers.
With the TCP, UDP and SCTP protocols, optional ports may be specified as:
{port/port-port}[,ports[,...]]
The '-' notation specifies a range of ports (including boundaries).
Fragmented packets that have a non-zero offset (i.e., not the first fragment) will never match a rule that has one or more
port specifications. See the frag option for details on matching fragmented packets.
Fragmented packets that have a non-zero offset (i.e., not the first fragment) will never match a rule that has one or more
port specifications. See the frag option for details on matching fragmented packets.