Brocade Communications Systems ServerIron ADX 12.4.00a - Manual (Page 107)

ServerIron ADX Security Guide 93
53-1002440-03
IACL overview
3
Applying an IPv6 ACL to an interface
To apply an IPv6 ACL to an interface, enter commands such as the following:
ServerIronADX(config)# interface ethernet 3/1
ServerIronADX(config-if-e100-3/1)# ipv6 traffic-filter access1 in
This example applies the IPv6 ACL “access1” to incoming IPv6 packets on Ethernet interface 3/1.
As a result, Ethernet interface 3/1 denies all incoming packets from the site-local prefix
fec0:0:0:2::/64 and the global prefix 2001:100:1::/48 and permits all other incoming packets.
Syntax: ipv6 traffic-filter <ipv6-acl-name> in
For the <ipv6-acl-name> parameter, specify the name of an IPv6 ACL created using the ipv6
access-list command.
The in keyword applies the specified IPv6 ACL to incoming IPv6 packets on the interface.
tcp-udp-operator The <tcp-udp-operator> parameter can be one of the following:
eq – The policy applies to the TCP or UDP port name or number you enter
after eq.
gt – The policy applies to TCP or UDP port numbers greater than the port
number or the numeric equivalent of the port name you enter after gt. Enter
"?" to list the port names.
lt – The policy applies to TCP or UDP port numbers that are less than the
port number or the numeric equivalent of the port name you enter after lt.
neq – The policy applies to all TCP or UDP port numbers except the port
number or port name you enter after neq.
range – The policy applies to all TCP port numbers that are between the first
TCP or UDP port name or number and the second one you enter following
the range parameter. The range includes the port names or numbers you
enter. For example, to apply the policy to all ports between and including 23
(Telnet) and 53 (DNS), enter the following: range 23 53. The first port
number in the range must be lower than the last number in the range.
The <source-port number> and <destination-port-number> for the
tcp-udp-operator is the number of the port.
ipv6-operator Allows you to filter the packets further by using one of the following options:
•
dscp – The policy applies to packets that match the traffic class value
in the traffic class field of the IPv6 packet header. This operator allows
you to filter traffic based on TOS or IP precedence. You can specify a
value from 0 – 63.
•
fragments – The policy applies to fragmented packets that contain a
non-zero fragment offset.
NOTE: This option is not applicable to filtering based on source or
destination port, TCP flags, and ICMP flags.
•
routing – The policy applies only to IPv6 source-routed packets.
NOTE: This option is not applicable to filtering based on source or
destination port, TCP flags, and ICMP flags.
log Allows statistics that match the ACL statement to be entered in the Syslog.
TABLE 6 Syntax Descriptions
Arguments... Description...