Efficient Networks 107-0001-000 manual Both

Chapter 18: Stateful Firewall Commands	Efficient Networks® Router family
	Command Line Interface Guide

The following <parameters> specify additional characteristics that an IP packet must have in order to match the firewall rule.

-sp <ICMP type> <first source port>[:<last source port>]

If the protocol is ICMP, the packet must match the specified ICMP type. If the pack- et is TCP or UDP, if only one source port is specified, the packet must have the specified port, or if a range is defined, a port that is within the specified source port range. If no source port is specified, the firewall rule matches any source port in the range 0 - 65535.

-dp <ICMP code> <first dest port>[:<last dest port>]

If the protocol is ICMP, the packet must match the specified ICMP code. If the pack- et is TCP or UDP, if only one port is specified, the packet must have the specified destination port, or if a range is defined, a port that is within the specified destina- tion port range. If no destination port is specified, the firewall rule matches any des- tination port in the range 0 - 65535.

-da <first dest ip addr>[:<last dest ip addr>]

The packet must have a destination IP address within the specified address range. If only one address is specified, the packet must have that destination IP address. If no destination IP address is specified, the firewall rule matches any valid IPV4 address.

-sa <first source ip addr>[:<last source ip addr>]

The packet must have a source IP address within the specified address range. If only one address is specified, the packet must have that source IP address. If no source IP address is specified, the firewall rule matches any valid IPV4 address.

-sm <source ip mask>

The firewall rule uses the specified mask when comparing the <first source ip ad- dr>...<last source ip addr> with the source IP address in the IP packet. If no source mask is specified, the mask used is 255.255.255.255.

-dm <dest ip mask>

The firewall rule uses the specified mask when comparing the <first dest ip ad- dr>...<last dest ip addr> with the destination IP address in the IP packet. If no des- tination mask is specified, the mask used is 255.255.255.255.

Specify one of these options to determine when watch messages are sent for this firewall rule. The messages are sent to the console serial port and, if configured, a Syslog server.

- q -v

If -q(quiet) is specified, no messages are displayed for this firewall rule, even if the rule causes a packet to be dropped.

If -v(verbose) is specified, a message is displayed every time this firewall matches a pack- et, regardless of the rule action. This is the default setting for firewall deny rules.

Specify one of these options to specify the direction of the packet of the packet to which the

firewall rule is applied. If no direction parameter is specified, the direction is defaulted to

both.

in out

Response

Command prompt.

Page 18-10 Efficient Networks®