Nortel Networks 2300 Series manual WSS# set security acl ip acl123 deny 192.168.2.11

468Security ACL Commands

History
WSS Software	The any option is supported for the source or destination IP address and
Version 4.1	mask. This option is equivalent to 0.0.0.0 255.255.255.255.

Note: The any option is shown in the configuration file as

0.0.0.0255.255.255.255, regardless of whether you specify any or

0.0.0.0255.255.255.255 when you configure the ACE.

The dscp codepoint is added. This option enables you to filter based on a packet’s Differentiated Services Code Point (DSCP) value.

Usage The WSS does not apply security ACLs until you activate them with the commit security acl command and map them to a VLAN, port, or virtual port, or to a user. If the WSS is reset or restarted, any ACLs in the edit buffer are lost.

You cannot perform ACL functions that include permitting, denying, or marking with a Class of Service (CoS) level on packets with a multicast or broadcast destination address.

The order of security ACEs in a security ACL is important. Once an ACL is active, its ACEs are checked according to their order in the ACL. If an ACE criterion is met, its action takes place and any ACEs that follow are ignored.

ACEs are listed in the order in which you create them, unless you move them. To position security ACEs within a

security ACL, use before editbuffer-index and modify editbuffer-index.

Examples The following command adds an ACE to security acl_123 that permits packets from IP address 192.168.1.11/24 and counts the hits:

WSS# set security acl ip acl_123 permit 192.168.1.11 0.0.0.255 hits

The following command adds an ACE to acl_123 that denies packets from IP address 192.168.2.11:

WSS# set security acl ip acl_123 deny 192.168.2.11 0.0.0.0

The following command creates acl_125 by defining an ACE that denies TCP packets from source IP address 192.168.0.1 to destination IP address 192.168.0.2 for established sessions only, and counts the hits:

WSS# set security acl ip acl_125 deny tcp 192.168.0.1 0.0.0.0 192.168.0.2 0.0.0.0 established hits

The following command adds an ACE to acl_125 that denies TCP packets from source IP address 192.168.1.1 to desti- nation IP address 192.168.1.2, on destination port 80 only, and counts the hits:

WSS# set security acl ip acl_125 deny tcp 192.168.1.1 0.0.0.0 192.168.1.2 0.0.0.0 eq 80 hits

Finally, the following command commits the security ACLs in the edit buffer to the configuration:

WSS# commit security acl all

configuration accepted

See Also

•clear security acl on page 449

•commit security acl on page 452

•show security acl on page 461

NN47250-100 (Version 02.51)