User Manual

Manage Device Security
662
M6100, M5300, and M7100 Series Managed Switches
configuring other match criteria is not offered. To configure specific match criteria for the
rule, remove the rule and recreate it, or reconfigure Match Every to False for the other
match criteria to be visible.
16. Use the Protocol Type field to specify that a packet's IP protocol is a match condition for the
selected IP ACL rule.
The possible values are ICMP, IGMP, IP, TCP, UDP, EIGRP, GRE, IPINIP, OSPF, and
PIM.
17. In the TCP Flag field, specify that a packet's TCP flag is a match condition for the selected
IP ACL rule.
The TCP flag values are URG, ACK, PSH, RST, SYN, and FIN. Each TCP flag can be set
separately. The possible values are as follows:
• Ignore. A packet matches this ACL rule whether the TCP flag in this packet is set or
not.
• Set (+). A packet matches this ACL rule if the TCP flag in this packet is set.
• Clear (-). A packet matches this ACL rule if the TCP flag in this packet is not set.
18. When Established is specified, a match occurs if either RST- or ACK-specified bits are set
in the TCP header. These fields are enabled only when TCP protocol is selected.
19. In the Src field, enter a source IP address, using dotted-decimal notation, to be compared to
a packet's source IP address as a match criteria for the selected IP ACL rule:
a. Select the IP Address option and enter an IP address with a relevant wildcard mask
to apply this criteria. If this field is left empty, it means any.
b. When you select the Host option, the wildcard mask is configured as 0.0.0.0. If this
field is left empty, it means any.
The wildcard mask determines which bits are used and which bits are ignored. A wildcard
mask of 0.0.0.0 indicates that none of the bits are important. A wildcard of
255.255.255.255 indicates that all of the bits are important.
20. Use Source L4 Port Action to specify relevant matching conditions for L4 port numbers in
the current extended ACL rule:
• Equal. IP ACL rule matches only if the Layer 4 source port number is equal to the
specified port number or port key.
• Less Than. IP ACL rule matches if the Layer 4 source port number is less than the
specified port number or port key.
• Greater Than. IP ACL rule matches if the Layer 4 source port number is greater than
the specified port number or port key.
• Not Equal. IP ACL rule matches only if the Layer 4 source port number is not equal to
the specified port number or port key.
21. Src L4 Port and Src L4 Range options are available only when protocol is set to TCP or
UDP. When you select the Port option, choose port key from the list or enter the port
number yourself.
• The source IP TCP port names are bgp, domain, echo, ftp, ftpdata, http, smtp, snmp,
Telnet, www, pop2, pop3.