Brocade FastIron Ethernet Switch Security Configuration Guide - Manual (Page 112)

Extended numbered ACL configuration
This section describes how to configure extended numbered ACLs.
Extended ACLs let you permit or deny packets based on the following information:
• IP protocol
• Source IP address or host name
• Destination IP address or host name
• Source TCP or UDP port (if the IP protocol is TCP or UDP)
• Destination TCP or UDP port (if the IP protocol is TCP or UDP)
The IP protocol can be one of the following well-known names or any IP protocol number from 0 - 255:
• Internet Control Message Protocol (ICMP)
• Internet Group Management Protocol (IGMP)
• Internet Gateway Routing Protocol (IGRP)
• Internet Protocol (IP)
• Open Shortest Path First (OSPF)
• Transmission Control Protocol (TCP)
• User Datagram Protocol (UDP)
For TCP and UDP, you also can specify a comparison operator and port name or number. For
example, you can configure a policy to block web access to a specific website by denying all TCP port
80 (HTTP) packets from a specified source IP address to the website IP address.
Extended numbered ACL syntax
Syntax: [no] access-list ACL-num { deny | permit } ip-protocol { source-ip | hostname wildcard } [
operator [ source-tcp | udp-port ] ] | destination-ip | hostname [ icmp-num | icmp-type ] wildcard [ tcp |
udp ] comparison operator destination [ tcp | udp port ] [ 802.1p-priority-matching 0-7 ] [ dscp-cos-
mapping ] [ dscp-marking 0-63 [ 802.1p-priority-marking 0-7... | dscp-cos-mapping ]] [ dscp-
matching 0-63 ] [ log ] [ precedence name | 0-7 ] [ tos 0-63 | name ] [ traffic-policy name ]
Syntax: [no] access-list ACL-num { deny | permit } host ip-protocol any any
Syntax: [no] ip access-group ACL-num [ in | out ]
The ACL-num parameter is the extended access list number. Specify a number from 100 - 199.
The deny | permit parameter indicates whether packets that match the policy are dropped or
forwarded.
The ip-protoco parameter indicates the type of IP packet you are filtering. You can specify a well-
known name for any protocol whose number is less than 255. For other protocols, you must enter the
number. Enter "?" instead of a protocol to list the well-known names recognized by the CLI.
The source-ip | hostname parameter specifies the source IP host for the policy. If you want the policy
to match on all source addresses, enter any .
The wildcard parameter specifies the portion of the source IP host address to match against. The
wildcard is in dotted-decimal notation (IP address format). It is a four-part value, where each part is 8
bits (one byte) separated by dots, and each bit is a one or a zero. Each part is a number ranging from
0 to 255, for example 0.0.0.255. Zeros in the mask mean the packet’s source address must match the
source-ip . Ones mean any value matches. For example, the source-ip and wildcard values
10.157.22.26 0.0.0.255 mean that all hosts in the Class C subnet 10.157.22.x match the policy.
Extended numbered ACL configuration
112 FastIron Ethernet Switch Security Configuration Guide
53-1003088-03