Brocade FastIron Ethernet Switch Security Configuration Guide User Manual
Page 120
NOTE
The QoS options listed below are only available if a specific ICMP type is specified for the icmp-type
parameter and cannot be used with the any-icmp-type option above. See
page 135 for more information on using ACLs to perform QoS.
The tcp/udp comparison operator parameter specifies a comparison operator for the TCP or UDP port
number. This parameter applies only when you specify tcp or udp as the IP protocol. For example, if
you are configuring an entry for HTTP, specify tcp eq http . You can enter one of the following
operators:
• eq - The policy applies to the TCP or UDP port name or number you enter after eq .
• established - This operator applies only to TCP packets. If you use this operator, the policy applies
to TCP packets that have the ACK (Acknowledgment) or RST (Reset) bits set on (set to "1") in the
Control Bits field of the TCP packet header. Thus, the policy applies only to established TCP
sessions, not to new sessions. Refer to Section 3.1, "Header Format", in RFC 793 for information
about this field.
NOTE
This operator applies only to destination TCP ports, not source TCP ports.
• gt - The policy applies to TCP or UDP port numbers greater than the port number or the numeric
equivalent of the port name you enter after gt .
• lt - The policy applies to TCP or UDP port numbers that are less than the port number or the
numeric equivalent of the port name you enter after lt .
• neq - The policy applies to all TCP or UDP port numbers except the port number or port name you
enter after neq .
• range - The policy applies to all TCP or UDP port numbers that are between the first TCP or UDP
port name or number and the second one you enter following the range parameter. The range
includes the port names or numbers you enter. For example, to apply the policy to all ports between
and including 23 (Telnet) and 53 (DNS), enter the following: range 23 53 . The first port number in
the range must be lower than the last number in the range.
The tcp/udp-port parameter specifies the TCP or UDP port number or well-known name. You can
specify a well-known name for any application port whose number is less than 1024. For other
application ports, you must enter the number. Enter "?" instead of a port to list the well-known names
recognized by the CLI.
The in | out parameter specifies that the ACL applies to incoming traffic on the interface to which you
apply the ACL. You can apply the ACL to an Ethernet port or a virtual interface.
NOTE
If the ACL is for a virtual routing interface, you also can specify a subset of ports within the VLAN
containing that interface when assigning an ACL to the interface. Refer to
on page 107.
The precedence name | num parameter of the ip access-list command specifies the IP precedence.
The precedence option for of an IP packet is set in a three-bit field following the four-bit header-length
field of the packet’s header. You can specify one of the following:
• critical or 5 - The ACL matches packets that have the critical precedence. If you specify the option
number instead of the name, specify number 5.
• flash or 3 - The ACL matches packets that have the flash precedence. If you specify the option
number instead of the name, specify number 3.
Rule-Based IP ACLs
120
FastIron Ethernet Switch Security Configuration Guide
53-1003088-03