HP VPN Firewall Appliances Access Control Command Reference

119
Views
System view
Default command level
2: System level
Parameters
rule-number: Number for the portal-free rule. The value ranges from 0 to 15.
any: Imposes no limitation on the previous keyword.
ip ipv4-address: Specifies an IPv4 address for the portal-free rule.
mask { mask-length | mask }: Specifies a mask or mask length for the IP address. The mask argument is
a subnet mask in dotted decimal notation. The mask-length argument is a subnet mask length, an integer
in the range of 0 to 32.
interface interface-type interface-number: Specifies a source interface.
mac mac-address: Specifies a source MAC address in the format H-H-H.
vlan vlan-id: Specifies a source VLAN ID.
all: Specifies all portal-free rules.
Usage guidelines
If you specify both a source IPv4 address and a source MAC address in a portal-free rule, the IP address
must be a host address with a 32-bit mask. Otherwise, the specified MAC address does not take effect.
If you specify both a VLAN and an interface in a portal-free rule, the interface must belong to the VLAN.
Otherwise, the rule does not take effect.
If you specify both a source port number and a destination port number for a portal-free rule, the source
and destination port numbers must belong to the same transport layer protocol.
You cannot configure a portal-free rule to have the same filtering criteria as that of an existing one. When
attempted, the system prompts that the rule already exists.
No matter whether portal authentication is enabled on an interface, you can only add or remove a
portal-free rule, rather than modifying it.
A Layer 2 interface in an aggregation group cannot be specified as the source interface of a portal-free
rule, and the source interface of a portal-free rule cannot be added to an aggregation group.
For Layer 2 portal authentication, you can configure only portal-free rules that are from any source
address to any or a specific destination address. When such a portal-free rule is configured, users can
access the specified address without portal authentication.
Examples
# Configure a portal-free rule, allowing any packet whose source IP address is 10.10.10.1/24 and source
interface is GigabitEthernet 0/1 to bypass portal authentication.
<Sysname> system-view
[Sysname] portal free-rule 15 source ip 10.10.10.1 mask 24 interface gigabitethernet 0/1
destination ip any
Related commands
display portal free-rule