Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 1

53-1002444-02June 2012®DRAFT: BROCADE CONFIDENTIAL53-1002444-02ServerIron ADXNAT64 Configuration GuideSupporting Brocade ServerIron ADX version 12.4.0

x ServerIron ADX NAT64 Configuration Guide53-1002444-02DRAFT: BROCADE CONFIDENTIALFor readability, command names in the narrative portions of this gui

88 ServerIron ADX NAT64 Configuration Guide53-1002444-02Enabling filtering for packets denied by flow-based ACLs5DRAFT: BROCADE CONFIDENTIAL• forward:

ServerIron ADX NAT64 Configuration Guide 8953-1002444-02Enabling strict TCP or UDP mode for flow-based ACLs5DRAFT: BROCADE CONFIDENTIAL• If the sessio

90 ServerIron ADX NAT64 Configuration Guide53-1002444-02Enabling strict TCP or UDP mode for flow-based ACLs5DRAFT: BROCADE CONFIDENTIALTo disable the

ServerIron ADX NAT64 Configuration Guide 9153-1002444-02ACLs and ICMP5DRAFT: BROCADE CONFIDENTIAL• The ACL packet counter feature provides an accurate

92 ServerIron ADX NAT64 Configuration Guide53-1002444-02ACLs and ICMP5DRAFT: BROCADE CONFIDENTIALThe commands in this example deny (drop) ICMP echo re

ServerIron ADX NAT64 Configuration Guide 9353-1002444-02ACLs and ICMP5DRAFT: BROCADE CONFIDENTIALNamed ACLsFor example, to deny the administratively-p

94 ServerIron ADX NAT64 Configuration Guide53-1002444-02ACLs and ICMP5DRAFT: BROCADE CONFIDENTIALhost-precedence-violation 3 14host-redirect 5 1host-t

ServerIron ADX NAT64 Configuration Guide 9553-1002444-02Using flow-based ACLs and NAT on the same interface5DRAFT: BROCADE CONFIDENTIALUsing flow-base

96 ServerIron ADX NAT64 Configuration Guide53-1002444-02Troubleshooting rule-based ACLs5DRAFT: BROCADE CONFIDENTIALTroubleshooting rule-based ACLsUse

ServerIron ADX NAT64 Configuration Guide 9753-1002444-02DRAFT: BROCADE CONFIDENTIALChapter6IPv6 Access Control ListsIn this chapter•In this chapter .

ServerIron ADX NAT64 Configuration Guide xi53-1002444-02DRAFT: BROCADE CONFIDENTIALNotice to the readerThis document may contain references to the tra

98 ServerIron ADX NAT64 Configuration Guide53-1002444-02IPv6 ACL overview6DRAFT: BROCADE CONFIDENTIAL• Source TCP or UDP port (if the IPv6 protocol is

ServerIron ADX NAT64 Configuration Guide 9953-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALBeginning with ServerIron ADX 12.3.01 and lat

100 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALThe second condition denies all IPv6 traffic

ServerIron ADX NAT64 Configuration Guide 10153-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALThe following commands apply the ACL called

102 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALThe deny statement denies ICMP neighbor disc

ServerIron ADX NAT64 Configuration Guide 10353-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALTable 13 describes the syntax used to config

104 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALUnsupported commands and message types The f

ServerIron ADX NAT64 Configuration Guide 10553-1002444-02Applying IPv6 ACLs to interfaces6DRAFT: BROCADE CONFIDENTIALTable 14 lists ICMPv6 message typ

106 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALServerIronADX(config)# interface ethernet 3/1

ServerIron ADX NAT64 Configuration Guide 10753-1002444-02Using an ACL to restrict SSH access6DRAFT: BROCADE CONFIDENTIALSyntax: show access-list bindi

xii ServerIron ADX NAT64 Configuration Guide53-1002444-02DRAFT: BROCADE CONFIDENTIAL

108 ServerIron ADX NAT64 Configuration Guide53-1002444-02Logging IPv6 ACLs6DRAFT: BROCADE CONFIDENTIALNOTEPermit logging is not currently supported.

ServerIron ADX NAT64 Configuration Guide 10953-1002444-02DRAFT: BROCADE CONFIDENTIALChapter7Network Address TranslationIn this chapter•In this chapter

110 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALConfiguring NAT The following types of NAT are sup

ServerIron ADX NAT64 Configuration Guide 11153-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALConfiguring static NATUse the ip nat inside source

112 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALConfiguring an address poolUse the ip nat pool com

ServerIron ADX NAT64 Configuration Guide 11353-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALEnabling IP NAT globallyThe following command enab

114 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALFigure 18 shows a dynamic NAT configuration on a S

ServerIron ADX NAT64 Configuration Guide 11553-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALFIGURE 19 Dynamic NAT translating inside host addr

116 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring NAT7DRAFT: BROCADE CONFIDENTIALStatic NAT configuration exampleThe following exam

ServerIron ADX NAT64 Configuration Guide 11753-1002444-02Forwarding packets without NAT translation7DRAFT: BROCADE CONFIDENTIALServerIronADX(config)#

ServerIron ADX NAT64 Configuration Guide 153-1002444-02DRAFT: BROCADE CONFIDENTIALChapter1NAT64 and NAT46 OverviewIn this chapter•Overview of NAT64 an

118 ServerIron ADX NAT64 Configuration Guide53-1002444-02Translation timeouts7DRAFT: BROCADE CONFIDENTIALFIGURE 21 Example of IP NAT with VIP overlapI

ServerIron ADX NAT64 Configuration Guide 11953-1002444-02Disabling IP NAT sticky behavior7DRAFT: BROCADE CONFIDENTIALConfiguring the NAT translation a

120 ServerIron ADX NAT64 Configuration Guide53-1002444-02Deleting IP NAT sticky sessions7DRAFT: BROCADE CONFIDENTIALSyntax: [no] ip nat disable-sticky

ServerIron ADX NAT64 Configuration Guide 12153-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALIP NAT redundancyThe ServerIron ADX supports sta

122 ServerIron ADX NAT64 Configuration Guide53-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALFIGURE 22 Minimum required configuration for dyn

ServerIron ADX NAT64 Configuration Guide 12353-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALServerIronADX(config)# access-list 10 permit 10.

124 ServerIron ADX NAT64 Configuration Guide53-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALFIGURE 23 Minimum required configuration for sta

ServerIron ADX NAT64 Configuration Guide 12553-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIAL3. Configure the static NAT entries on each Serv

126 ServerIron ADX NAT64 Configuration Guide53-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALFIGURE 24 Minimum required configuration for dyn

ServerIron ADX NAT64 Configuration Guide 12753-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALServerIronADX(config)# vlan 100ServerIronADX(con

2 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT64 and NAT46 implementation details1DRAFT: BROCADE CONFIDENTIALThe stateless NAT64 gateway g

128 ServerIron ADX NAT64 Configuration Guide53-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALServerIronADX-A(config)# interface ve 1ServerIro

ServerIron ADX NAT64 Configuration Guide 12953-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALConfiguring Static NAT redundancy in Sym-Active

130 ServerIron ADX NAT64 Configuration Guide53-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALThe server router-ports command enables the Serv

ServerIron ADX NAT64 Configuration Guide 13153-1002444-02IP NAT redundancy7DRAFT: BROCADE CONFIDENTIALassociates this state change with VRID 1 and cau

132 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT information7DRAFT: BROCADE CONFIDENTIALNote that each VIP group can have only

ServerIron ADX NAT64 Configuration Guide 13353-1002444-02Displaying NAT information7DRAFT: BROCADE CONFIDENTIALSyntax: show ip nat statistics [0]: h:

134 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT information7DRAFT: BROCADE CONFIDENTIALnat tcp rev no ports avl Indicates the

ServerIron ADX NAT64 Configuration Guide 13553-1002444-02Displaying NAT information7DRAFT: BROCADE CONFIDENTIALNOTEThree ranges are displayed in the o

136 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT information7DRAFT: BROCADE CONFIDENTIALDisplaying NAT redundancy informationYo

ServerIron ADX NAT64 Configuration Guide 13753-1002444-02Clearing NAT entries from the table7DRAFT: BROCADE CONFIDENTIALSyntax: show ip vrrp-e briefCl

ServerIron ADX NAT64 Configuration Guide 353-1002444-02NAT64 and NAT46 implementation details1DRAFT: BROCADE CONFIDENTIALRequirements for stateless NA

4 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT64 and NAT46 implementation details1DRAFT: BROCADE CONFIDENTIALTable 2 shows how ICMPv4 mess

ServerIron ADX NAT64 Configuration Guide 553-1002444-02NAT64 and NAT46 implementation details1DRAFT: BROCADE CONFIDENTIALNAT64 full-sized packet handl

6 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT64 and NAT46 implementation details1DRAFT: BROCADE CONFIDENTIALNOTEBecause the ICMP checksum

ServerIron ADX NAT64 Configuration Guide 753-1002444-02DRAFT: BROCADE CONFIDENTIALChapter2Stateful NAT64 ConfigurationIn this chapter•Stateful NAT64 o

DRAFT: BROCADE CONFIDENTIAL©© 2012 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabri

8 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateful NAT64 overview2DRAFT: BROCADE CONFIDENTIALThe DNS64 server provides the IPv6 client wi

ServerIron ADX NAT64 Configuration Guide 953-1002444-02Basic stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIAL5. The NAT64 gateway also dynamic

10 ServerIron ADX NAT64 Configuration Guide53-1002444-02Basic stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALTo specify an IPv6 prefix, enter

ServerIron ADX NAT64 Configuration Guide 1153-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALNOTEIf the ServerIron ADX run

12 ServerIron ADX NAT64 Configuration Guide53-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALFigure 4 shows a typical IPv6

ServerIron ADX NAT64 Configuration Guide 1353-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALThe inject-static-route optio

14 ServerIron ADX NAT64 Configuration Guide53-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALNOTEIf the ServerIron ADX run

ServerIron ADX NAT64 Configuration Guide 1553-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALServerIron ADX(config)# route

16 ServerIron ADX NAT64 Configuration Guide53-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALOnce this command is configur

ServerIron ADX NAT64 Configuration Guide 1753-1002444-02Advanced stateful NAT64 configuration2DRAFT: BROCADE CONFIDENTIALHost: foo.com\r\n…Connection:

ServerIron ADX NAT64 Configuration Guide iii53-1002444-02DRAFT: BROCADE CONFIDENTIALContentsAbout This DocumentAudience . . . . . . . . . . . . . . .

18 ServerIron ADX NAT64 Configuration Guide53-1002444-02High availability for stateful NAT642DRAFT: BROCADE CONFIDENTIALFor more information about NAT

ServerIron ADX NAT64 Configuration Guide 1953-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALServerIron ADX(config)# nat64 pool nat

20 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALServerIron ADX1/1 show session all 0Se

ServerIron ADX NAT64 Configuration Guide 2153-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALDisplaying NAT64 statisticsYou can use

22 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIAL UDP 6->4 = 0 UDP 4

ServerIron ADX NAT64 Configuration Guide 2353-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALStateless IPv6 prefix prepended = Stat

24 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALTCP 4->6 = # stateless NAT64 TCP I

ServerIron ADX NAT64 Configuration Guide 2553-1002444-02Displaying NAT64 information2DRAFT: BROCADE CONFIDENTIALDisplaying NAT64 resourcesYou can use

26 ServerIron ADX NAT64 Configuration Guide53-1002444-02Clearing stateful NAT64 information2DRAFT: BROCADE CONFIDENTIALClearing stateful NAT64 informa

ServerIron ADX NAT64 Configuration Guide 2753-1002444-02DRAFT: BROCADE CONFIDENTIALChapter3Stateless NAT64 ConfigurationIn this chapter•Stateless NAT6

iv ServerIron ADX NAT64 Configuration Guide53-1002444-02DRAFT: BROCADE CONFIDENTIALAdvanced stateful NAT64 configuration . . . . . . . . . . . . . .

28 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 overview3DRAFT: BROCADE CONFIDENTIALThe DNS64 server provides the IPv6 client

ServerIron ADX NAT64 Configuration Guide 2953-1002444-02Stateless NAT64 overview3DRAFT: BROCADE CONFIDENTIALFIGURE 8 IPv4 client to DNS64 server commu

30 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIALFIGURE 9 Stateless NAT

ServerIron ADX NAT64 Configuration Guide 3153-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIAL• Stateless NAT64 pack

32 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIALStateless NAT64 static

ServerIron ADX NAT64 Configuration Guide 3353-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIALTasks to configure a S

34 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIALThe inject-static-rout

ServerIron ADX NAT64 Configuration Guide 3553-1002444-02Stateless NAT64 static mapping configuration3DRAFT: BROCADE CONFIDENTIALServerIron ADX(config-

36 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 dynamic mapping configuration3DRAFT: BROCADE CONFIDENTIAL• If the ipv6 frag-fu

ServerIron ADX NAT64 Configuration Guide 3753-1002444-02Stateless NAT64 dynamic mapping configuration3DRAFT: BROCADE CONFIDENTIALAdvanced configuratio

ServerIron ADX NAT64 Configuration Guide v53-1002444-02DRAFT: BROCADE CONFIDENTIALNAT46 static mapping configuration . . . . . . . . . . . . . . . . .

38 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT64 dynamic mapping configuration3DRAFT: BROCADE CONFIDENTIALConfiguring NAT64 hol

ServerIron ADX NAT64 Configuration Guide 3953-1002444-02Stateless NAT64 dynamic mapping configuration3DRAFT: BROCADE CONFIDENTIALUse the nat64 ipv4-pr

40 ServerIron ADX NAT64 Configuration Guide53-1002444-02High availability for NAT643DRAFT: BROCADE CONFIDENTIALThe <holdoff-interval> variable i

ServerIron ADX NAT64 Configuration Guide 4153-1002444-02Clearing NAT64 information3DRAFT: BROCADE CONFIDENTIALThe all parameter displays all of the co

42 ServerIron ADX NAT64 Configuration Guide53-1002444-02Debugging stateless NAT64 configurations3DRAFT: BROCADE CONFIDENTIALThe <IPv6_address> v

ServerIron ADX NAT64 Configuration Guide 4353-1002444-02DRAFT: BROCADE CONFIDENTIALChapter4Stateless NAT46 ConfigurationIn this chapter•Stateless NAT4

44 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT46 overview4DRAFT: BROCADE CONFIDENTIALThe ServerIron ADX is configured as a stat

ServerIron ADX NAT64 Configuration Guide 4553-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIAL5. The IPv6 client replies using

46 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALRoute injection can be used in a

ServerIron ADX NAT64 Configuration Guide 4753-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALNOTEA maximum of 1024 entries is

vi ServerIron ADX NAT64 Configuration Guide53-1002444-02DRAFT: BROCADE CONFIDENTIALDisplaying rule-based ACL entries . . . . . . . . . . . . . . . . .

48 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALNOTEFor details about how to con

ServerIron ADX NAT64 Configuration Guide 4953-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALConfiguring static NAT46 IPv4 pr

50 ServerIron ADX NAT64 Configuration Guide53-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALStateless NAT46 static route inj

ServerIron ADX NAT64 Configuration Guide 5153-1002444-02NAT46 static mapping configuration4DRAFT: BROCADE CONFIDENTIALIf you are running a ServerIron

52 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT46 dynamic mapping configuration4DRAFT: BROCADE CONFIDENTIALStateless NAT46 dynam

ServerIron ADX NAT64 Configuration Guide 5353-1002444-02Stateless NAT46 dynamic mapping configuration4DRAFT: BROCADE CONFIDENTIALThe stateless operand

54 ServerIron ADX NAT64 Configuration Guide53-1002444-02Stateless NAT46 dynamic mapping configuration4DRAFT: BROCADE CONFIDENTIALThe <holdoff-inter

ServerIron ADX NAT64 Configuration Guide 5553-1002444-02High availability for NAT464DRAFT: BROCADE CONFIDENTIALThe <prefix/subnet> variable spec

56 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying NAT46 information4DRAFT: BROCADE CONFIDENTIAL• Each ServerIron ADX is configured wi

ServerIron ADX NAT64 Configuration Guide 5753-1002444-02Clearing NAT46 information4DRAFT: BROCADE CONFIDENTIALDisplaying in-progress dynamic NAT46 map

ServerIron ADX NAT64 Configuration Guide vii53-1002444-02DRAFT: BROCADE CONFIDENTIALChapter 7 Network Address TranslationIn this chapter . . . . . . .

58 ServerIron ADX NAT64 Configuration Guide53-1002444-02Debugging NAT46 configurations4DRAFT: BROCADE CONFIDENTIALThe all parameter clears all of the

ServerIron ADX NAT64 Configuration Guide 5953-1002444-02DRAFT: BROCADE CONFIDENTIALChapter5Access Control ListsIn this chapter•In this chapter . . . .

60 ServerIron ADX NAT64 Configuration Guide53-1002444-02How ServerIron ADX ADX processes ACLs5DRAFT: BROCADE CONFIDENTIALFor pass-through traffic, pac

ServerIron ADX NAT64 Configuration Guide 6153-1002444-02How ServerIron ADX ADX processes ACLs5DRAFT: BROCADE CONFIDENTIALConfiguration guidelines for

62 ServerIron ADX NAT64 Configuration Guide53-1002444-02How ServerIron ADX ADX processes ACLs5DRAFT: BROCADE CONFIDENTIAL• If both the fragment’s sour

ServerIron ADX NAT64 Configuration Guide 6353-1002444-02ACL entries and the Layer 4 CAM5DRAFT: BROCADE CONFIDENTIALYou configure ACLs on a global basi

64 ServerIron ADX NAT64 Configuration Guide53-1002444-02ACL entries and the Layer 4 CAM5DRAFT: BROCADE CONFIDENTIALDisplaying the number of Layer 4 CA

ServerIron ADX NAT64 Configuration Guide 6553-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALNOTEIf you enter the ip access-group ma

66 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALSyntax: [no] access-list <num> de

ServerIron ADX NAT64 Configuration Guide 6753-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALConfiguring extended numbered ACLsThis

viii ServerIron ADX NAT64 Configuration Guide53-1002444-02DRAFT: BROCADE CONFIDENTIAL

68 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALThe third entry denies IGRP traffic fro

ServerIron ADX NAT64 Configuration Guide 6953-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALSyntax: [no] access-list <num> de

70 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIAL• If you do not specify a message type,

ServerIron ADX NAT64 Configuration Guide 7153-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIALThe <tcp/udp-port> parameter spec

72 ServerIron ADX NAT64 Configuration Guide53-1002444-02Configuring rule-based ACLs5DRAFT: BROCADE CONFIDENTIAL• <num>: A number from 0 through

ServerIron ADX NAT64 Configuration Guide 7353-1002444-02Modifying rule-based ACLs5DRAFT: BROCADE CONFIDENTIALNotice that the command prompt changes af

74 ServerIron ADX NAT64 Configuration Guide53-1002444-02Modifying rule-based ACLs5DRAFT: BROCADE CONFIDENTIALReordering ACLsWhen you use the Foundry d

ServerIron ADX NAT64 Configuration Guide 7553-1002444-02Modifying rule-based ACLs5DRAFT: BROCADE CONFIDENTIALaccess-list 1 deny host 209.157.22.26 log

76 ServerIron ADX NAT64 Configuration Guide53-1002444-02Adding, replacing, or deleting comments to rule-based ACLs5DRAFT: BROCADE CONFIDENTIALSyntax:

ServerIron ADX NAT64 Configuration Guide 7753-1002444-02Adding, replacing, or deleting comments to rule-based ACLs5DRAFT: BROCADE CONFIDENTIALDeleting

ServerIron ADX NAT64 Configuration Guide ix53-1002444-02DRAFT: BROCADE CONFIDENTIALAbout This DocumentAudienceThis document is designed for system adm

78 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying rule-based ACL entries5DRAFT: BROCADE CONFIDENTIALReplacing comments applied to nam

ServerIron ADX NAT64 Configuration Guide 7953-1002444-02Displaying rule-based ACL entries5DRAFT: BROCADE CONFIDENTIALServerIronADX# show access-list 9

80 ServerIron ADX NAT64 Configuration Guide53-1002444-02Displaying rule-based ACL entries5DRAFT: BROCADE CONFIDENTIALDisplaying ACLs using numerical k

ServerIron ADX NAT64 Configuration Guide 8153-1002444-02Displaying rule-based ACL entries5DRAFT: BROCADE CONFIDENTIALEnter the begin <keyword> p

82 ServerIron ADX NAT64 Configuration Guide53-1002444-02ACL logging5DRAFT: BROCADE CONFIDENTIALEnter the include <keyword> display only those li

ServerIron ADX NAT64 Configuration Guide 8353-1002444-02ACL logging5DRAFT: BROCADE CONFIDENTIALSyslog message for changed ACL modeIf the device change

84 ServerIron ADX NAT64 Configuration Guide53-1002444-02ACL logging5DRAFT: BROCADE CONFIDENTIALIn this example, the two-line message at the bottom is

ServerIron ADX NAT64 Configuration Guide 8553-1002444-02Dropping all fragments that exactly match a flow-based ACL5DRAFT: BROCADE CONFIDENTIAL• IGMP •

86 ServerIron ADX NAT64 Configuration Guide53-1002444-02Enabling ACL filtering of fragmented packets5DRAFT: BROCADE CONFIDENTIALEnabling ACL filtering

ServerIron ADX NAT64 Configuration Guide 8753-1002444-02Enabling ACL filtering of fragmented packets5DRAFT: BROCADE CONFIDENTIALYou can protect agains