User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
159
# add dest-maclist -mac <MACaddress>|-ciscoprot
Use the -ciscoprot switch to add the destination addresses
for the most common Cisco protocols to the destination MAC
address filter list.
Delete a single device from the ACL or all filtered MAC
addresses with the
del dest-maclist command:
# del dest-maclist -all|-mac <MACaddress>
You must be logged on to an administrator-level account to
change configuration settings (refer to Section 2.2).
4.6.3 IP Address Packet Filter
Although the Fortress Mesh Point is a Layer-2 device, it has
the capability to filter IP packets. The user can create filter rules
on each interface, wired or wireless, to permit or deny packets
based on:
 IPv4
 Source address / mask (prefix length)
 Destination address / mask (prefix length)
 Protocol
 IPv6
 Source address / mask (prefix length)
 Destination address / mask (prefix length)
 Next header (Protocol)
 TCP
 Source port
 Destination port
 UDP
 Source port
 Destination port
A user may configure up to 16 rules per interface. Enabling
packet filters on an interface adds an extra automatically
generated rule to the interface. This rule denies (drops) all IP
packets which did not match any configured filter rule.
Add packet filter rules with
add pktfilter:
# add pktfilter -name <filterName> -action permit|deny -log Y|N
-type ipv4|ipv6|tcp|udp -interface <interfaceName>
-priority <1..16> -srcaddr <srcAddress> -srcpl <srcPrefixLen>
-destaddr <destAddress> -destpl <destPrefixLen>
-protocol <protocolNumber> -srcport <srcPort>
-destport <destPort>
You must specify the following information in order to create a
packet filter rule: