Extreme Networks Summit 300-48 - Manual (Page 111)

Using Access Control Lists
Summit 300-48 Switch Software User Guide 111
The permit-established Keyword
The permit-established keyword is used to directionally control attempts to open a TCP session.
Session initiation can be explicitly blocked using this keyword.
NOTE
For an example of using the permit-established keyword, refer to “Using the Permit-Established
Keyword” on page 116.
The permit-established keyword denies the access control list. Having a permit-established access
control list blocks all traffic that matches the TCP source/destination, and has the SYN=1 and ACK=0
flags set.
Adding Access Mask, Access List, and Rate Limit Entries
Entries can be added to the access masks, access lists, and rate limits. To add an entry, you must supply
a unique name using the
create command, and supply a number of optional parameters (see Table 39
for the full command syntax). For access lists and rate limits, you must specify an access mask to use.
To modify an existing entry, you must delete the entry and retype it, or create a new entry with a new
unique name.
To add an access mask entry, use the following command:
create access-mask ...
To add an access list entry, use the following command:
create access-list ...
To add a rate limit entry, use the following command:
create rate-limit ...
Maximum Entries
If you try to create an access mask when no more are available, the system will issue a warning
message. Three access masks are constantly used by the system, leaving a maximum of 13
user-definable access masks. However, enabling some features causes the system to use additional
access masks, reducing the number available.
For each of the following features that you enable, the system will use one access mask. When the
feature is disabled, the mask will again be available. The features are:
• IGMP or OSPF (both would share a single mask)
• DiffServ examination
• QoS monitor