Reference Guide

Dell PowerConnect ArubaOS 6.0 Command Line Interface | Reference Guide ip access-list session | 263
Syntax
Parameter Description
<accname> Enter a name for this ACL
ipv6 Use the ipv6 keyword to create IPv6 specific rules.
<source> The traffic source, which can be one of the following:
alias: specify the network resource (use the netdestination command to configure aliases; use the show
netdestination command to see configured aliases)
any: match any traffic
host: specify a single host IP address
localip: specify the local IP address to match traffic
network: specify the IP address and netmask
user: represents the IP address of the user
<dest> The traffic destination, which can be one of the following:
alias: specify the network resource (use the netdestination command to configure aliases; use the show
netdestination command to see configured aliases)
any: match any traffic
host: specify a single host IP address
localip: specify the local IP address to match traffic
network: specify the IP address and netmask
user: represents the IP address of the user
<service> Network service, which can be one of the following:
IP protocol number (0-255)
name of a network service (use the show netservice command to see configured services)
any: match any traffic
tcp: specify the TCP port number (0-65535)
udp: specify the UDP port number (0-65535)
<action> Action if rule is applied, which can be one of the following:
deny: reject packets
dst-nat: perform destination NAT on packets
dual-nat: perform both source and destination NAT on packets
permit: forward packets
redirect: specify the location to which packets are redirected, which can be one of the following:
z datapath destination ID (0-65535)
z esi-group: specify the ESI server group configured with the esi group command
z opcode: specify the datapath destination ID (0x33, 0x34, or 0x82). Do not use this parameter without
proper guidance from Dell PowerConnect
tunnel: specify the ID of the tunnel configured with the interface tunnel command
src-nat: perform source NAT on packets
<extended ac
tion>
Optional action if rule is applied, which can be one of the following:
blacklist: blacklist user
disable-scanning: pause ARM scanning while traffic is present. Note that you must enable “Voice Aware
Scanning” in the ARM profile for this feature to work.
dot1p-priority: specify 802.1p priority (0-7)
log: generate a log message
mirror: mirror all session packets to datapath or remote destination
If you configure the mirror option, define the destination to which mirrored packets are sent in the
firewall policy. For more information, see “firewall” on page 197.
position: specify the position of the rule (1 is first, default is last)
queue: assign flow to priority queue (high/low)
send-deny-response: if <action> is deny, send an ICMP notification to the source
time-range: specify time range for this rule (configured with time-range command)
tos: specify ToS value (0-63)