User Manual

M4300 Intelligent Edge Series Fully Managed Stackable Switches
Manage Switch Security User Manual620
The wildcard mask determines which bits are used and which bits are ignored. A
wildcard mask of 0.0.0.0 indicates that none of the bits are important. A wildcard
of 255.255.255.255 indicates that all of the bits are important.
• IGMP Type. If you specify the IGMP type, the IP ACL rule matches the specified
IGMP message type. Possible values are in the range 0 to 255. If this field is left
empty, it means any.
• ICMP. Select either the ICMP T
ype or ICMP Message radio button:
- If you select the ICMP T
ype radio button, note the following:
• The ICMP T
ype and ICMP Code fields are enabled only if the protocol is
ICMP. Use these fields to specify a match condition for ICMP packets:
• The IP
ACL rule matches the specified ICMP message type. Possible type
numbers are in the range from 0 to 255.
• If you specify information in the ICMP Code field, the IP
ACL rule matches the
specified ICMP message code. Possible values for the code can be in the
range from 0 to 255.
• If these fields are left empty
, it means any.
- If you select the ICMP Message radio button, select the type of the ICMP
message to match with the selected IP
ACL rule. Specifying a type of message
implies that both the ICMP type and ICMP code are specified. The ICMP
message is decoded into the corresponding ICMP type and ICMP code within the
ICMP type.
The IPv4 ICMP message types are: echo, echo-reply, host-redirect,
mobile-redirect, net-redirect, net-unreachable, redirect, packet-too-big,
port-unreachable, source-quench, router-solicitation, router-advertisement,
time-exceeded, ttl-exceeded, and unreachable.
• Fragments. Either select Enable to allow initial fragments (that is, the fragment bit is
asserted) or leave the default setting at Disable to prevent initial fragments from
being used.
This option is not valid for rules that match L4 information such as TCP port number,
because that information is carried in the initial packet.
• Service Type. Select a service type match condition for the extended IP
ACL rule.
The possible values are IP DSCP, IP precedence, and IP T
OS, which are alternative
methods to specify a match criterion for the same service type field in the IP header.
Each method uses a different user notation. After you make a selection is made, you
can specify the appropriate values.
- IP DSCP.
This is an optional configuration. Specify the IP DiffServ Code Point
(DSCP) field. The DSCP is defined as the high-order 6 bits of the service type
octet in the IP header. Enter an integer from 0 to 63. To select the IP DSCP, select
one of the DSCP keywords from the menu. To specify a numeric value, select
Other and a field displays in which you can enter numeric value of the DSCP.