This entry matches all type 3 ICMP packets (destination unreachable) with a code between 1 and 5 (included).
2.5.2.6 ENTRY <id> PROTOCOL
Establishes the IP packet protocol sentence. This command must be followed by the protocol number (value
between 0 and 255) or name. If you specify IP protocol, any protocol is admitted.
This command grants or denies access to certain protocols.
Syntax:
Extended Access List #>entry <id> protocol ?
<0..255>
An IP protocol number
esp
Encapsulation Security Payload
gre
Generic Routing Encapsulation
icmp
Internet Control Message Protocol
igmp
Internet Gateway Message Protocol
ip
Any Internet Protocol
ospf
OSPF routing protocol
pim
Protocol Independent Multicast
tcp
Transmission Control Protocol
udp
User Datagram Protocol
Example:
Extended Access List 100>entry 3 protocol icmp
Extended Access List 100>
2.5.2.7 ENTRY <id> PROTOCOL-RANGE
Establishes the protocol sentence or the range of protocols for the IP packet. This command must be followed by two
numbers. The first indicates the protocol identifier in the lower range and the second is the identifier in the higher
range. If you do not want to set a range, simply enter two equal values. Both protocol identifiers can take values
between 0 and 255.
The purpose of this command is to grant or deny access to various protocols.
Syntax:
Extended Access List #>entry <id> protocol-range <lower_port> <higher_port>
Example:
Extended Access List 100>entry 3 protocol-range 21 44
Extended Access List 100>
2.5.2.8 ENTRY <id> DS-FIELD
Establishes the Access Control sentence based on the value of the dscp field for the IP packet Type of Service byte.
This can take values between 0 and 63.
Syntax:
Extended Access List #>entry <id> ds-field <value>
Example:
Extended Access List 100>entry 3 ds-field 12
Extended Access List 100>
2.5.2.9 ENTRY <id> LABEL
Establishes the IP packet label sentence. The label is an internal parameter associated to each packet. It is made up
of a number between 0 and 99 that can be used to select, classify and filter IP traffic.
By default, all IP packets have an associated label value equal to 0. This value may be changed through Policy Rout-
ing (please see manual
bintec Dm745-I Policy Routing
), using a duly configured Route Map (
bintec Dm764-I Route
Mapping
). Traffic marked with a label can be subsequently selected in an access list through the entry <id> label
command.
Syntax:
2 Configuration
bintec elmeg
18
Access Control
