6-61
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter6 Managing Policy Objects
Creating Access Control List Objects
•Understanding Networks/Hosts Objects, page 6-74
•Understanding and Specifying Services and Service and Port List Objects, page 6-86
•Filtering Items in Selectors, page 1-42
Field Reference
Table6-23 Add and Edit Web Access Control Entry Dialog Boxes
Element Description
Type The type of entry you are adding. The fields on the dialog box change
based on your selection.
•Access Control Entry—You want to define an ACE.
•ACL Objects—You want to include an existing ACL object. You
are presented with a list of available ACL objects. Select the
objects you want to include and click the >> button to move them
to the list of selected objects. You can remove an object by
selecting it and clicking <<. You can also edit objects in the
selected objects list.
Action The action to take on traffic defined in the entry:
•Permit—The service associated with this ACL is applied to this
traffic. That is, the traffic is permitted to use the service.
•Deny—The service associated with this ACL is not applied to this
traffic. If there are multiple ACLs configured for a service, denied
traffic is typically compared to the next ACL in the list; if it
matches no permit entry in any ACL for the service, the service is
not applied to the traffic. Whether the traffic is dropped from the
network depends on the service.
Filter Destination Whether the entry specifies a network filter (host or network address)
or a URL filter (web site address). Your selection changes the fields on
the dialog box. The fields are described below.
Destination
(Network Filter only.)
The destination of the traffic. You can enter more than one value by
separating the items with commas.
You can enter any combination of the following address types. For more
information, see Specifying IP Addresses During Policy Definition,
page 6-81.
•Network/host object. Enter the name of the object or click Select
to select it from a list. You can also create new network/host objects
from the selection list.
•Host IP address, for example, 10.10.10.100.
•Network address, including subnet mask, in either the format
10.10.10.0/24 or 10.10.10.0/255.255.255.0.
•A range of IP addresses, for example, 10.10.10.100-10.10.10.200.
•An IP address pattern in the format 10.10.0.10/255.255.0.255,
where the mask is a discontiguous bit mask (see Contiguous and
Discontiguous Network Masks for IPv4 Addresses, page 6-75).