HP VPN Firewall Appliances Access Control Command Reference

48
Default command level
2: System level
Parameters
ip-address-start ip-address-end: Specifies a range of IP addresses by specifying a start IP address and an
end IP address. The end IP address must be higher than the start IP address.
exclude ip-address: Specifies an IP address to be excluded from the IP address range.
Usage guidelines
An address range object can comprise only one range of IP addresses. If you execute the range
command multiple times, the most recent configuration takes effect.
Only after you add an IP address range to an address range object, can you exclude IP addresses from
the range. You can use the range exclude ip-address command multiple times to exclude multiple IP
addresses from the IP address range.
Examples
# Add IP address range 2.2.2.2 through 2.2.2.20 to address range object rangetest on the default VD
and exclude 2.2.2.10 from the range.
<Sysname> system-view
[Sysname] object network range rangetest
[Sysname-obj-network-rangetest] range 2.2.2.2 2.2.2.20
[Sysname-obj-network-rangetest] range exclude 2.2.2.10
# Add IP address range 2.2.2.2 through 2.2.2.20 to address range object rangetest on VD virdev and
exclude 2.2.2.10 from the range.
<Sysname> system-view
[Sysname] switchto vd virdev
[Sysname-vsys-virdev] object network range rangetest
[Sysname-vsys-virdev-obj-network-rangetest] range 2.2.2.2 2.2.2.20
[Sysname-vsys-virdev-obj-network-rangetest] range exclude 2.2.2.10
subnet
Use subnet net-address wildcard-mask to add a subnet IP address to a subnet address object.
Use subnet exclude ip-address to exclude an IP address from the subnet IP address.
Use undo subnet exclude ip-address to add an excluded IP address back to the subnet IP address.
Use undo subnet to restore the default.
Syntax
subnet { net-address wildcard-mask | exclude ip-address }
undo subnet [ exclude ip-address ]
Default
A subnet address object has no subnet IP address members.
Views
Subnet address object view