User guide

158 ExtremeWare 7.2e Installation and User Guide
Security
Adding an Access Profile Entry
Next, configure the access profile, using the following command:
configure access-profile <access profile> add {<seq_number>} {permit | deny}
[ipaddress <ip address> <mask> {exact} | as-path <path-expression> | bgp-community
[internet | no-export | no-advertise | no-export-subconfed | <as_no:number> | number
<community>] | ipxnet <netid> <netid mask> | ipxsap <sap_type> <service_name> | vlan]
The following sections describe the configure access-profile add command.
Specifying Subnet Masks
The subnet mask specified in the access profile command is interpreted as a reverse mask. A reverse
mask indicates the bits that are significant in the IP address. In other words, a reverse mask specifies the
part of the address that must match the IP address to which the profile is applied.
If you configure an IP address that is an exact match that is specifically denied or permitted, use a mask
of /32 (for example, 141.251.24.28/32). If the IP address represents all addresses in a subnet address that
you want to deny or permit, then configure the mask to cover only the subnet portion (for example,
141.251.10.0/24). The keyword
exact can be used when you wish to match only against the subnet
address, and ignore all addresses within the subnet.
If you are using off-byte boundary subnet masking, the same logic applies, but the configuration is
more tricky. For example, the network address 141.251.24.128/27 represents any host from subnet
141.251.24.128.
Sequence Numbering
You can specify the sequence number for each access profile entry. If you do not specify a sequence
number, entries are sequenced in the order they are added. Each entry is assigned a value of 5 more
than the sequence number of the last entry.
Permit and Deny Entries
If you have configured the access profile mode to be none, you must specify each entry type as either
‘permit’ or ‘deny’. If you do not specify the entry type, it is added as a permit entry. If you have
configured the access profile mode to be
permit or deny, it is not necessary to specify a type for each
entry.
Autonomous System Expressions
The AS-path keyword uses a regular expression string to match against the AS path. Regular expression
notation can include any of the characters listed in Table 30.
Table 30: Regular Expression Notation
Character Definition
N As number
N
1
- N
2
Range of AS numbers, where N
1
and N
2
are AS numbers and N
1
< N
2
[N
x
... N
y
] Group of AS numbers, where N
x
and N
y
are AS numbers or a range of AS numbers
[^N
x
... N
y
] Any AS numbers other than the ones in the group