User Manual

Managing Device Security
484
M6100 Web Management User Guide
3. Specify the Action to take if a packet matches the rule's criteria. The choices are Permit or
Deny.
4. Set Logging to Enable to enable logging for this ACL rule (subject to resource availability in
the device). If the Access List Trap Flag is also enabled, this will cause periodic traps to be
generated indicating the number of times this rule was hit during the current report interval.
A fixed 5 minute report interval is used for the entire system. A trap is not issued if the ACL
rule hit count is zero for the current interval. This field is visible for a Deny Action.
5. In the Assign Queue ID, specify the hardware egress queue identifier used to handle all
packets matching this IP ACL rule. The valid range of Queue IDs is 0 to 6.
6. Use the Mirror Interface field to specify the specific egress interface where the matching
traffic stream is copied, in addition to being forwarded normally by the device. This field
cannot be set if a Redirect Interface is already configured for the ACL rule. This field is
visible for a Permit Action.
7. Use the Redirect Interface field to specify the specific egress interface where the matching
traffic stream is forced, bypassing any forwarding decision normally performed by the device.
This field cannot be set if a Mirror Interface is already configured for the ACL rule. This field
is enabled for a Permit Action.
8. Select True or False from the Match Every menu. True signifies that all packets will match
the selected IP ACL and Rule and will be either permitted or denied. In this case, since all
packets match the rule, the option of configuring other match criteria will not be offered. To
configure specific match criteria for the rule, remove the rule and re-create it, or re-configure
Match Every to False for the other match criteria to be visible.
9. Use the Protocol Type field to specify that a packet's IP protocol is a match condition for the
selected IP ACL rule. The possible values are ICMP, IGMP, IP, TCP, UDP, EIGRP, GRE,
IPINIP, OSPF, and PIM.
10. In the TCP Flag field, specify that a packet's TCP flag is a match condition for the selected
IP ACL rule. The TCP flag values are URG, ACK, PSH, RST, SYN, and FIN. Each TCP flag
has the possible values below and can be set separately:
• Ignore — A packet matches this ACL rule whether the TCP flag in this packet is set or
not.
• Set (+) — A packet matches this ACL rule if the TCP flag in this packet is set.
• Clear(-) — A packet matches this ACL rule if the TCP flag in this packet is not set.
11. When Established is specified, a match occurs if either RST- or ACK-specified bits are set
in the TCP header. These fields are enabled only when TCP protocol is selected.
12. In the Src field, enter a source IP Address, using dotted-decimal notation, to be compared to
a packet's source IP Address as a match criteria for the selected IP ACL rule.
a. Select the IP Address option and enter an IP address with a relevant wild card mask
to apply this criteria. If this field is left empty, it means any.
b. When you select the Host option, the wild card mask is configured as 0.0.0.0. If this
field is left empty, it means any.
The wild card mask determines which bits are used and which bits are ignored. A wild
card mask of 0.0.0.0 indicates that none of the bits are important. A wild card of
255.255.255.255 indicates that all of the bits are important.