Compatible-systems 5.4 Manuel d'utilisateur télécharger pdf (Page 192)

186 Chapter 11 - TCP/IP Filtering

Rule sets that have been created with the TCP/IP Route Filter Editor Window

must be applied using the pull-down menus in the Main TCP/IP Filtering

Dialog Box.

Basic IP Route Filter Rules and Syntax

At a minimum, every non-comment line in a filter set must include an action,

and an IP address. Together these components specify a filter rule that the

device will follow when sending and/or receiving IP routing packets.

Every line in a route filter set must begin with the actions permit or deny, or

the comment indicator #.

• Lines which begin with permit specify that information from routing

packets meeting the conditions should be included in the IP routing table.

• Lines which begin with deny specify that information from packets

meeting the conditions should not be included in the IP routing table.

• Lines which begin with # specify that the text on the line is a comment

and should be ignored.

Every line which begins with permit or deny must be followed by an IP

address. This IP address can be specified in a number of different ways.

• Addresses can be specified in dotted-decimal notation. If the rightmost

components are 0, they are treated as wildcards. For example,

128.138.12.0 matches all hosts on the 128.138.12 subnet. An address

with all zeros matches anything.

• A factorized format can also be used where a set of components are

substituted into an address. These addresses take the form of

#.#.#.{#,#,...}. For example, 192.12.9.{1,2,15} matches the hosts

192.12.9.1, 192.12.9.2, and 192.12.9.15. The factor set must be at the end

of the address, but addresses of the form #.{#,#,...}, #.#.{#,#,...}, etc., are

allowed. Any components past the factor set’s position are implicitly

assumed to be 0.

• IP addresses may also be specified as a hexadecimal number (for

example, 0x82cc0801 matches the host address 130.204.8.1).

Any address may have an optional /bits field at its end. This denotes the

number of bits, starting with the most significant, that will be considered by

the device when it compares the address in a routing packet to the filter rule.

For example, an address specified in the rules as 192.15.32.0/19 would match

all host addresses from 192.15.32.1 to 192.15.63.255.

Any part of an address which is past the number of significant bits specified

is ignored and assumed to be zero.

1 2 ... 187 188 189 190 191 192 193 194 195 196 197 ... 312 313

Pas de commentaire

Compatible-systems 5.4 Manuel d'utilisateur Page 192