3Com 10014299 Configure the match sequence of access control list, Operator and Syntax Meaning

Firewall Overview 553

Table 620 Mnemonic Symbol of the ICMP Message Type

Operator and Syntax	Meaning
echo	Type=8, Code=0
echo-reply	Type=0, Code=0
fragmentneed-DFset	Type=3, Code=4
host-redirect	Type=5, Code=1
host-tos-redirect	Type=5, Code=3
host-unreachable	Type=3, Code=1
information-reply	Type=16,Code=0
information-request	Type=15,Code=0
net-redirect	Type=5, Code=0
net-tos-redirect	Type=5, Code=2
net-unreachable	Type=3, Code=0
parameter-problem	Type=12,Code=0
port-unreachable	Type=3, Code=3
protocol-unreachable	Type=3, Code=2
reassembly-timeout	Type=11,Code=1
source-quench	Type=4, Code=0
source-route-failed	Type=3, Code=5
timestamp-reply	Type=14,Code=0
timestamp-request	Type=13,Code=0
ttl-exceeded	Type=11,Code=0

By configuring the firewall and adding appropriate access rules, you can use packet filtering to check IP packets that pass the router. The passing of unexpected packets can thus be prohibited. In this way the packet filtering helps to protect the network security.

Configure the match sequence of access control list

An access control rule can be composed of several “permit” and “deny” statements and the range of the data packet specified by each statement varies. The match sequence needs to be configured when matching a data packet and access control rule.

The maximum number of rules configured under an acl-numberis 500 (that is, 500 rules can be configured in normal time range, and 500 rules can also be configured in special time range), and the number of total rules under all acl-numberare not more than 500. When there is a conflict among several rules, the system will configure the match rules according to the following principle:

■Rules with the same serial number can be defined. If two rules with the same serial number conflict, use the “depth-first” principle to judge the source-addr,source-wildcard-mask,destination-addr,destination-wildcard-mask,protocol number and port number, then determine the sequence of the rule.

■If the ranges defined by the rules are the same, then determine the sequence of the rules according to the time sequence of definition. The system will choose the rule defined earlier.