Configuring reverse masks for ACLs on the USG2000 and USG5000 series

8

Write out a mask with 0 and 1 and perform a reverse operation.

Other related questions:
How to configure the mask of an ACL on a WLAN device
For WLAN devices, masks (wildcards) must be specified for the source and destination IP addresses in ACL rules. The wildcard is in dotted decimal notation. In a binary wildcard, the value 0 indicates that this bit needs to be matched and the value 1 indicates that this bit does not need to be matched. 0s and 1s in a wildcard can be discontinuous. For example, the IP address 192.168.1.169 and the wildcard 0.0.0.172 represent address 192.168.1.x0x0xx01. x can be 0 or 1.

Method used to configure the mask in the ACL on the AR
Masks in ACL rules configured on the AR series routers and S series switches are wildcard masks. The wildcard mask is also called wildcard and is in dotted decimal notation. When the wildcard is converted to a binary value, the value 0 indicates that the bit is matched and the value 1 indicates that the bit is not matched. The value 0 or l of a binary value can be incontiguous. For example, the IP address is 192.168.1.169 and the wildcard is 0.0.0.172, representing that the network address is 192.168.1.x0x0xx01. The value of x can be 0 or 1.
Example:  system-view
[Huawei] acl number 2000
[Huawei-acl-basic-2000] rule permit source 192.168.32.1 0 //Permit only a specific IP address, with the wildcard mask of 0.0.0.0 that is abbreviated as 0.
[Huawei-acl-basic-2000] rule permit source 192.168.32.0 0.0.0.255 //Permit a network segment (mask 255.255.255.0), with the wildcard mask of 0.0.0.255. The wildcard mask is used in an ACL.

Configure address masks in ACLs on S series switches
For S series switches (except S1700 switches): An address mask must be specified when a source IP address or destination IP address is configured in an ACL rule. The address mask is the wildcard. In a binary wildcard, the value 0 indicates that this bit needs to be matched and the value 1 indicates that this bit does not need to be matched. 0s and 1s in a wildcard can be discontinuous. For example, the IP address 192.168.1.169 and the wildcard 0.0.0.172 represent address 192.168.1.x0x0xx01. x can be 0 or 1.

Problem and solution when the forward and reverse paths of sessions are inconsistent on the USG2000 and USG5000
Configure sticky load balancing on the device.

Configuring IPS for the USG2000 and USG5000
Configure IPS on the USG2000 or USG5000. The procedure is as follows: 1. Configure global IPSec parameters. system-view //Access the system view. ips enable //Enable the IPS function. system-view //Access the system view. ips mode { protective | warning } //Configure the IPS operating mode. 2. Configure the IPS signature, upgrade the predefined signature, or configure a custom signature. The procedure for configuring a custom signature is as follows: ips signature signature-id //Create a custom IPS signature and access the IPS signature view. a. name name //Configure the name of the custom IPS signature. b. protocol protocol-name [ [ severity { informational | notification | warning | error | critical } ] | [ direction { to-server | to-client | any } ] | [ source-ip { any | ip-address mask } ] | [ source-port { any | port-number | high | low } ] | [ destination-ip { any | ip-address mask } ] | [ destination-port { any | port-num | high | low } ] | [ offset { { packet | stream } offset-value | any } ] | [ max-stream-len { stream-len | any } ] ] * //Configure the protocol, severity, and direction of the custom IPS signature. c. regex regex //Configure the description of behavioral characteristics of attacks. 3. Configure the IPS policy. ips policy policy-name //Access the IPS policy view. signature-set signature-set-name //Create a signature set and access the signature set view. direction enable //Enable the function of filtering signatures in the signature set based on signature directions. direction { { to-server | to-client | any } * | all } //Add signatures of the specified direction to the signature set. severity enable //Enable the function of filtering signatures in the signature set based on signature severities. severity { above | below } { informational | notification | warning | error |critical } //Add signatures of the specified severity to the signature set. reliability enable //Enable the function of filtering signatures in the signature set based on signature reliability. reliability { above | below } { low | medium | high } //Add signatures of the specified reliability to the signature set. protocol enable //Enable the function of filtering signatures in the signature set based on protocols. protocol { protocol-name &<1-10> | all } //Add signatures of the specified protocol to the signature set. protocol enable //Enable the function of filtering signatures in the signature set based on categories. category mode { or | and } //Configure the matching mode for categories in the signature set. category { category-name &<1-10> | all } //Add signatures of the specified category to the signature set. signature-set [ enable ] action { alert | block } //Configure the enabling status and response mode of the signature set. signature-set move signature-set-name1 { before | after } signature-set-name2 //Modify the priority of the signature set. ips policy policy-name //Create an IPS policy named policy-name. override-signature signature-id enable action { block | alert } //Enable signature overriding and configure the response mode. 4. Apply the IPS policy. policy zone zone-name //Access the intra-zone firewall policy view. policy interzone zone-name1 vpn-instance vpn-instance-name zone-name2 { inbound | outbound }, //Access the inter-zone firewall policy view. policy policy-id //Create a firewall policy and access the policy ID view. action permit //Configure the action of the firewall policy to permit. policy ips ips-policy //Apply the IPS policy.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top