3com WX4400 3CRWX440095A Manuel D’Utilisation
Creating and Committing a Security ACL
385
Setting TCP and UDP
ACLs
Security ACLs can filter TCP and UDP packets by source and destination IP
address, precedence, and TOS level. You can apply a TCP ACL to
established TCP sessions only, not to new TCP sessions. In addition,
security ACLs for TCP and UDP can filter packets according to a source
port on the source IP address and/or a destination port on the destination
IP address, if you specify a port number and an operator in the ACE. (For
a list of TCP and UDP port numbers, see
address, precedence, and TOS level. You can apply a TCP ACL to
established TCP sessions only, not to new TCP sessions. In addition,
security ACLs for TCP and UDP can filter packets according to a source
port on the source IP address and/or a destination port on the destination
IP address, if you specify a port number and an operator in the ACE. (For
a list of TCP and UDP port numbers, see
.)
The operator indicates whether to filter packets arriving from or destined
for a port whose number is equal to (eq), greater than (gt), less than (lt),
not equal to (neq), or in a range that includes (range) the specified port.
To specify a range of TCP or UDP ports, you enter the beginning and
ending port numbers.
for a port whose number is equal to (eq), greater than (gt), less than (lt),
not equal to (neq), or in a range that includes (range) the specified port.
To specify a range of TCP or UDP ports, you enter the beginning and
ending port numbers.
The CLI does not accept port names in ACLs. To filter on ports by name, you must use 3Com Wireless Switch Manager. For more information, see the
Wireless Switch Manager Reference Manual
.
Setting a TCP ACL
The following command filters TCP packets:
set security acl ip acl-name {permit [cos cos] | deny}
tcp {source-ip-addr mask | any} [operator port [port2]]
{destination-ip-addr mask | any [operator port [port2]]}
[[precedence precedence] [tos tos] | [dscp codepoint]]
[established] [before editbuffer-index | modify
editbuffer-index] [hits]
tcp {source-ip-addr mask | any} [operator port [port2]]
{destination-ip-addr mask | any [operator port [port2]]}
[[precedence precedence] [tos tos] | [dscp codepoint]]
[established] [before editbuffer-index | modify
editbuffer-index] [hits]
Time Exceeded (11)
Time to Live (TTL) Exceeded (0)
Fragment Reassembly Time Exceeded (1)
Parameter Problem (12)
None
Timestamp (13)
None
Timestamp Reply (14)
None
Information Request (15)
None
Information Reply (16)
None
Table 32 Common ICMP Message Types and Codes (continued)
ICMP Message Type (Number) ICMP Message Code (Number)