Enterasys Networks XSR CLI - page 561

IPSec Commands
XSR CLI Reference Guide 14-107
Syntax
access-list acl-number {deny | permit} protocol [source_addr source_mask [eq port]
destination_addr destination_mask [eq port]
Syntax of the “no” Form
Thenoformofthiscommandremovestheaccesslist:
no access-list acl-number {deny | permit} protocol [source_addr source_mask [eq
port] destination_addr destination_mask [eq port]
Default
AnextendedACLdefaultstoalistthatdenieseverything.
Mode
Globalconfiguration:XSR(config)#
Examples
ThefollowingexampleconfigurestwoIPACLs:
XSR(config)#access-list 100 permit ip 0.0.0.0 255.255.255.255 192.168.1.0
XSR(config)#access-list 101 permit ip 0.0.0.0 255.255.255.255 host 10.123.234.45
ThefollowingACLssecureL2TP:
XSR(config)#access-list 120 permit udp any eq 1701 any
XSR(config)#access-list 130 permit udp any any eq 1701
acl-number Auniquelydefinedaccesslistnumber.
deny PreventstrafficfrombeingprotectedbyIPSecinthecontextofa
particularcryptomapentry:itdoesnotallowthepolicyassetin
crypto mapstatementstobeappliedtothistraffic.
permit CausesallIPtrafficthatmatchesthespecifiedconditionstobe
protectedbyIPSecusingthepolicydescribedbythecorresponding
crypto mapcommandstatements.
protocol NameornumberofanIPprotocol.Itcanbeoneofthekeywordsip,
tcp,orudp,oranintegerrangingfrom1to254representinganIP
protocolnumber.TomatchanyInternetprotocol,includingTCP,
andUDP,usethekeywordip.
eq port Aclausetodefineamatchingsourceand/ordestinationport
number.Sourceand/ordestinationisdefinedbythelocationofthe
eqkeywordinthecommand.Aportnumberofzeromatchesany
port.MayonlybeusedwithTCPandUDPprotocols.
source-addr Addressofthenetworkorhostfromwhichthepacketissent.
source-mask Netmaskbits(mask)tobeappliedtosource_addr.
destination-addr IPaddressofthenetworkorhosttowherethepacketissent.
destination-mask Netmaskbits(mask)tobeappliedtodestination_addr.