Ip firewall filter – Enterasys Networks X-Pedition XSR CLI User Manual
Page 661
Firewall Feature Set Commands
XSR CLI Reference Guide 16-117
Default
Disabled globally
Mode
Global or Interface configuration:
XSR(config)#
or
XSR(config-if<xx>)#
Example
The following example enables the firewall globally:
XSR(config)#ip firewall enable
ip firewall filter
This command defines the filter object for non‐TCP and UDP traffic, for which no stateful
inspection is required. By default, all non‐TCP and UDP traffic is dropped by the firewall. To
allow certain IP protocols to pass through the firewall, a filter object must be configured.
Filtering is performed on the protocol ID and source and destination addresses which are network
objects. Protocols can be specified by number or name. If a name is used, it should match that
specified by the Internet Assigned Numbers Authority (IANA). Refer to:
A name for any firewall object must use these alpha‐numeric characters only:
A
‐
Z
(upper or lower
case),
0
‐
9
,
-
(dash), or
_
(underscore). Also, all firewall object names including pre‐defined
objects such as ANY_EXTERNAL and user‐defined object names are case‐sensitive.
Syntax
ip firewall filter filter_name src_net_name dst_net_name {protocol-id prot-number
| protocol-name prot-name} [type number] [allow-log] bidirectional
Syntax of the “no” Form
The no form of this command disables the specified filter:
no ip firewall filter filter_name
Note: Logging for the filter is performed on a per packet basis.
filter_name
Name of filter object, not to exceed 16 characters.
src_net_name
Name of any source network object. Limit: 16 characters.
dst_net_name
Name of destination network object. Limit: 16 characters.
protocol-id
Protocol specified by decimal value.
protocol-name
Protocol specified by name, not to exceed 16 characters.
type number
If the protocol is ICMP, you can filter specific types only.
bidirectional
Policy applies in both directions. That is, for a session initiated at the
source as well as the destination.
allow-log
All matching packets are logged.