Reference Guide

240 | firewall cp Dell PowerConnect W-Series ArubaOS 6.1 CLI | Reference Guide
firewall cp
firewall cp {deny|permit} proto <IP protocol number> ports <start port number>
<last port number> [bandwidth-contract <name>]
no ...
Description
This command creates whitelist session ACLs. Whitelist ACLs consist of rules that explicitly permit or deny
session traffic from being forwarded or not to the controller. This prohibits traffic from being automatically
forwarded to the controller if it was not specifically denied in a blacklist.The maximum number of entries allowed
in the whitelist is 64.
Syntax
Usage Guidelines
This command turns the session ACL from a blacklist to a whitelist. A rule must exist that explicitly permits the
session before it is forwarded to the controller and the last rule in the list denies everything else.
Example
The following command creates a whitelist ACL that allows traffic using protocol 6 on ports 5000 through 6000
to be forwarded to the controller.
(host) (config-fw-cp) #firewall cp permit proto 6 ports 5000 6000
The following command creates a a whitelist ACL entry that denies traffic using protocol 2 on port 5000 from
being forwarded to the controller:
(host) (config-fw-cp) #firewall cp deny proto 2 ports 5000 5000
Parameter Description Range Default
deny Specifies the entry to reject on the session ACL whitelist — disabled
proto Indicates the protocol. — —
IP protocol number Specifies the IP protocol number that is rejected. 1-255 —
ports Port that the session traffic is using —
start port Specifies the start port 1-65535
last port Specifies the last port 1-65535
permit Specifies an entry that is allowed on the session ACL
whitelist
—
proto Protocol that the session traffic is using — —
IP protocol number Specifies the IP protocol number that is allowed 1-255 —
ports Indicates the port on which session traffic is running —
start port Specifies the starting port, in the port range, on which
session traffic is running.
1-65535
last port Specifies the last port, in the port range, on which session
traffic is running.
1-65535
bandwidth-contract <name> Specify the name of a bandwidth contract defined via the
cp-bandwidth-contract command.
—