Patton electronic SmartNode 4110 Series ユーザーズマニュアル

Access control list configuration task list

SmartWare Software Configuration Guide 

Where the syntax is as following:

If you place a deny ip any any rule at the top of an access-list profile, no packets will pass regardless of the other 
rules you defined.

Example: Create ICMP access control list entries 

Select the access-list profile named WanRx and create the rules to filter all ICMP echo requests (as used by the 
ping command).

node(cfg)#profile acl WanRx
node(pf-acl)[WanRx]#deny icmp any any type 8 code 0
node(pf-acl)[WanRx]#exit
node(cfg)# 

The source address to be included in the rule. An IP address in dotted-decimal-format, e.g. 
64.231.1.10.

A wildcard for the source address. Expressed in dotted-decimal format this value specifies 
which bits are significant for matching. One-bits in the wildcard indicate that the corre-
sponding bits are ignored. An example for a valid wildcard is 0.0.0.255, which specifies 
a class C network.

Indicates that IP traffic to or from all IP addresses is to be included in the rule.

The address of a single source host.

The destination address to be included in the rule. An IP address in dotted-decimal-format, 
e.g. 64.231.1.10

dest-wildcard A wildcard for the destination address. See src-wildcard.
host dest

The address of a single destination host.

The ICMP message name. The following are valid message names:

administratively-prohibited, alternate-address, conversion-error, dod-host-prohibited, dod-
net-prohibited, echo, echo-reply, general-parameter-problem, host-isolated, host-prece-
dence-unreachable, host-redirect, host-tos-redirect, host-tos-unreachable, host-unknown, 
host-unreachable, information-reply, information-request, mask-reply, mask-request, mobile-
redirect, net-redirect, net-tos-redirect, net-tos-unreachable, net-unreachable, network-
unknown, no-room-for-option, option-missing, packet-too-big, parameter-problem, port-
unreachable, precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect, 
router-advertisement, router-solicitation, source-quench, source-route-failed, time-exceeded, 
timestamp-reply, timestamp-request, traceroute, ttl-exceeded, unreachable

The ICMP message type. A number from 0 to 255 (inclusive)

The ICMP message code. A number from 0 to 255 (inclusive)

Optional. Specifies that packets matched by this rule belong to a certain Class of Service 
(CoS). For detailed description of CoS configuration refer to chapter 13,

CoS group name.