Administration of the Avaya G350 Media Gateway - Avaya Support

Defining rulesThe composite command can be any command defined in the composite operation list. Thesecommands are case-sensitive. To view the composite operation list for the access control listyou are working with, type the command show composite-operation in the context of theaccess control list.The following example defines a rule in Access Control List 301 that denies access to allincoming packets that contain IP fragments:G350-001(super)# ip access-control-list 301G350-001(super/ACL 301)# ip-fragments-in DenyDone!Defining rulesThis section provides information on how to configure rules in a policy list and contains thefollowing topics:●●●Overview of rule criteria — an overview of the criteria that can be used in configuring policyrulesEditing and creating rules — instructions on how to edit or create a policy ruleRule criteria — instructions on how to configure a policy rule’s criteriaOverview of rule criteriaYou can configure policy rules to match packets based on one or more of the following criteria:●●●●●Source IP address, or a range of addressesDestination IP address or a range of addressesIP protocol, such as TCP, UDP, ICMP, IGMPSource TCP or UDP port or a range of portsDestination TCP or UDP port or a range of ports● ICMP type and codeUse IP wildcards to specify a range of source or destination IP addresses. The zero bits in thewildcard correspond to bits in the IP address that remain fixed. The one bits in the wildcardcorrespond to bits in the IP address that can vary. Note that this is the opposite of how bits areused in a subnet mask.For access control lists, you can require the packet to be part of an established TCP session. Ifthe packet is a request for a new TCP session, the packet does not match the rule. You can alsospecify whether an access control list accepts packets that have an IP option field.Issue 3 January 2005 261