Netgear XSM4324FS User Manual - Page 624

M4300 Intelligent Edge Series Fully Managed Stackable Switches • Action. Specify what action is taken if a packet matches the rule's criteria. The choice is Permit or Deny. • Logging. When set to Enable, logging is enabled for this ACL rule (subject to resource availability in the device). If the access list trap flag is also enabled, this causes periodic traps to be generated indicating the number of times this rule was hit during the current report interval. A fixed 5-minute report interval is used for the entire system. A trap is not issued if the ACL rule hit count is zero for the current interval. This field is visible for a Deny action. • Egress Queue. The hardware egress queue identifier used to handle all packets matching this IPv6 ACL rule. Valid range of queue IDs is 0 to 7. This field is visible when Permit is chosen as the action. • Interface. For a Permit action, use either a mirror interface or a redirect interface: - Select the Mirror Interface radio button and use the menu to specify the egress interface to which the matching traffic stream is copied, in addition to being forwarded normally by the device. - Select the Redirect Interface radio button and use the menu to specify the egress interface to which the matching traffic stream is forced, bypassing any forwarding decision normally performed by the device. • Match Every. From the menu, select True or False. True signifies that all packets must match the selected IPv6 ACL and rule and are either permitted or denied. In this case, because all packets match the rule, the option of configuring other match criteria is not available. To configure specific match criteria for the rule, remove the rule and recreate it, or select False from the Match Every menu. • Protocol Type. Specify the IPv6 protocol Type in one of the following ways: - From the Protocol Type menu, select IPv6, TCP, UDP, or ICMPv6. - From the Protocol Type menu, select Other, and in the associated field, specify an integer ranging from 1 to 255. This number represents the IPv6 protocol. • TCP Flag. For each TCP flag, specify whether or not a packet's TCP flag must be matched. The TCP flag values are URG, ACK, PSH, RST, SYN, and FIN. You can set each TCP flag separately to one of the following options: - Ignore. The packet's TCP flag is ignored. This is the default setting. - Set (+). A packet matches this ACL rule if the TCP flag in this packet is set. - Clear (-). A packet matches this ACL rule if the TCP flag in this packet is not set. Note: If the RST and ACK flags are set, the option Established is available, indicating that a match occurs if either the RST- or ACK-specified bits are set in the packet's header. • Src. In the Src field, enter a source IPv6 address to be compared to a packet's source IPv6 address as a match criteria for the selected IPv6 ACL rule: - If you select the IPv6 Address radio button, enter an IPv6 address to apply this criteria. If this field is left empty, it means any. Manage Switch Security 624 User Manual