Efficient Networks 107-0001-000 manual Protocol TCP UDP Icmp

Efficient Networks® Router family	Chapter 5: Ethernet Interface Commands
Command Line Interface Guide

If the packet matches the filter, the specified <action> is performed:

accept The packet is allowed to proceed for further processing.

drop The packet is discarded, without sending an ICMP (Internet Control Management Protocol) error message.

reject The packet is discarded and an ICMP error message is returned to the sender.

inipsec The packet is passed to IPSec for decrypting. The filter is intended to match packets coming from the other IPSec gateway. Although fil- ters are the mechanism by which packets are passed to IPSec, it is recommended that you use IKE to manage your IP Security (see “IP- Sec (Internet Protocol Security)” on page 5-50.)

outipsec The packet is passed to IPSec so it can be encrypted and sent to the other IPSec gateway. The filter is intended to match packets coming from the local protected network. Although filters are the mechanism by which packets are passed to IPSec, it is recommended that you use IKE to manage your IP Security (see “IPSec (Internet Protocol Se- curity)” on page 5-50.)

The following parameters specify the characteristics that an IP packet must have in order to match the filter. A filter can require any or all of these characteristics.

-p <protocol> TCP UDP ICMP

The packet must have the specified protocol. If no protocol is specified, the filter matches every protocol.

-sa <first source ip addr>[:<last source ip addr>]

The packet must have a source IP address within the specified address range. If only one address is specified, the packet must have that source IP address. If no source IP address is specified, the filter matches any address in the range 0.0.0.0:255.255.255.255.

-sm <source ip mask>

The filter uses the specified mask when comparing the <first source ip addr>...<last source ip addr> with the source IP address in the IP packet. If no source mask is specified, the mask used is 255.255.255.255.

-sp <ICMP type> <first source port>[:<last source port>]

The packet must have a source port that matches the specified ICMP type or that is within the specified port range. If only one port is specified, the packet must have that source port. If no source port is specified, the filter matches any source port in the range 0:0xffff.

-da <first dest ip addr>[:<last dest ip addr>]

The packet must have a destination IP address within the specified address range. If only one address is specified, the packet must have that destination IP address. If no destination IP address is specified, the filter matches any address in the range 0.0.0.0:255.255.255.255.

-dm <dest ip mask>

The filter uses the specified mask when comparing the <first dest ip addr>...<last dest ip addr> with the destination IP address in the IP packet. If no destination mask is specified, the mask used is 255.255.255.255.

Efficient Networks® Page 5-23