Alcatel-Lucent 6600 - page 552

Using ACL Security Features Configuring ACLs
page 25-20 OmniSwitch 6600 Family Network Configuration Guide April 2006
2Add the services created in Step 1 to a service group called DropServices using the policy service
group command. For example:
-> policy service group DropServices tcp135 tcp445 udp137 udp138 udp445
Note that the DropServices group must be specified using the exact capitalization as shown in the
above example.
3Create a condition with the DropServices group defined in Step 2 and a source port group using the
policy port group and policy condition commands. For example:
-> policy port group badGuyPorts 5/1 6/1
-> policy condition badGuys source port group badGuyPorts service group DropServices
4Create a condition with the DropServices group defined in Step 2 and a source VLAN. For example:
-> policy condition goodGuys source vlan 20 service group DropServices
5Create a drop action and an accept action using the policy action disposition command. For example:
-> policy action DROP disposition drop
-> policy action ACCEPT disposition accept
6Create a deny rule for the source ports and an accept rule for the source VLAN using the policy rule
command. For example:
-> policy rule r1 condition badGuys action DROP
-> policy rule r2 condition goodGuys action ACCEPT
7Apply the ACL configuration using the qos apply command.
-> qos apply
The resulting ACL will drop traffic received on the specified source ports that is destined for service ports
identified in the DropServices group, while at the same time allowing traffic originating on VLAN 20 to
use these same services. The following shows what this ACL looks like in its entirety:
-> policy service tcp135 destination tcp port 135
-> policy service tcp445 destination tcp port 445
-> policy service udp137 destination udp port 137
-> policy service udp138 destination udp port 138
-> policy service udp445 destination udp port 445
-> policy service group DropServices tcp135 tcp445 udp137 udp138 udp445
-> policy port group badGuyPorts 5/1 6/1
-> policy condition badGuys source port group badGuyPorts service group DropServices
-> policy action DROP disposition drop
-> policy action ACCEPT disposition accept
-> policy rule r1 condition badGuys action DROP
-> policy rule r2 condition goodGuys action ACCEPT
-> qos apply