Technical data

ServerIron ADX NAT64 Configuration Guide 89
53-1002288-02
ACL overview
5
DRAFT: BROCADE CONFIDENTIAL
ICMP Message Configurations
If you want to specify an ICMP message, you can enter one of the following:
• beyond-scope
• destination-unreachable
• echo-reply
<ipv6-destination-prefix>/<prefix-l
ength>
The <ipv6-destination-prefix>/<prefix-length> parameter specify a
destination prefix and prefix length that a packet must match for the
specified action (deny or permit) to occur. You must specify the
<ipv6-destination-prefix> parameter in hexadecimal using 16-bit values
between colons as documented in RFC 2373. You must specify the
<prefix-length> parameter as a decimal value. A slash mark (/) must follow
the <ipv6-prefix> parameter and precede the <prefix-length> parameter
any When specified instead of the <ipv6-source-prefix>/<prefix-length> or
<ipv6-destination-prefix>/<prefix-length> parameters, matches any IPv6
prefix and is equivalent to the IPv6 prefix::/0.
host Allows you specify a host IPv6 address. When you use this parameter, you
do not need to specify the prefix length. A prefix length of all128 is implied.
tcp-udp-operator The <tcp-udp-operator> parameter can be one of the following:
eq – The policy applies to the TCP or UDP port name or number you enter
after eq.
gt – The policy applies to TCP or UDP port numbers greater than the port
number or the numeric equivalent of the port name you enter after gt. Enter
"?" to list the port names.
lt – The policy applies to TCP or UDP port numbers that are less than the
port number or the numeric equivalent of the port name you enter after lt.
neq – The policy applies to all TCP or UDP port numbers except the port
number or port name you enter after neq.
range – The policy applies to all TCP port numbers that are between the first
TCP or UDP port name or number and the second one you enter following
the range parameter. The range includes the port names or numbers you
enter. For example, to apply the policy to all ports between and including 23
(Telnet) and 53 (DNS), enter the following: range 23 53. The first port
number in the range must be lower than the last number in the range.
The <source-port number> and <destination-port-number> for the
tcp-udp-operator is the number of the port.
ipv6-operator Allows you to filter the packets further by using one of the following options:
• dscp – The policy applies to packets that match the traffic class value
in the traffic class field of the IPv6 packet header. This operator allows
you to filter traffic based on TOS or IP precedence. You can specify a
value from 0 – 63.
• fragments – The policy applies to fragmented packets that contain a
non-zero fragment offset.
NOTE: This option is not applicable to filtering based on source or
destination port, TCP flags, and ICMP flags.
• routing – The policy applies only to IPv6 source-routed packets.
NOTE: This option is not applicable to filtering based on source or
destination port, TCP flags, and ICMP flags.
log Allows statistics that match the ACL statement to be entered in the Syslog.
TABLE 13 Syntax Descriptions
Arguments... Description...