Appendix E: Filter File Syntax
•
•
Access-Control List (ACL) Definitions
The only definition appearing in the filter part of a filter file is the define acl definition block, which defines
This definition block has the same syntax and semantics as a CPL define subnet definition block, except that the keyword subnet is replaced by the keyword acl. The IP addresses or subnets are considered to have a Boolean OR relationship, no matter whether they are all on one line or separate lines. The syntax for the define acl definition block is as follows:
define acl label
{ip_addresssubnet} {ip_addresssubnet}...
...
end acl label
where:
•
•
•
Sections
Filter files support three kinds of sections:
•Prefix sections, for
•
•
A section within a filter file is similar to the equivalent section that appears in a standard CPL policy file; however,
The appearance of a section header within a filter file indicates that all subsequent filter entries are to be interpreted as specified within the section header. In addition, sections may contain ALL statements and define acl definition blocks, but these do not affect the semantics of the section or the way in which the ALL statement and definitions are evaluated.
Note that in the absence of filter section headers, filters are considered to be prefix filters unless they contain one or more regular expression metacharacters. If a filter entry does contain regular expression metacharacters, it is considered to be a regular expression. If section headers are used, the ProxySG automatically checks to ensure that regular expression filter entries only appear within the
Prefix Sections
303
