I would use a Dynamic Access Control list here to keep things easy if you are new to ACLs on ExtremeXOS. It's possible to write a policy file for the ACL's, but you have to be familiar with the Rule Syntax. Dynamic ACL similfies the command structure for you when you are first getting used to Extreme's syntax.
Let's say your three private networks are 10.1.1.0/24, 10.1.2.0/24 and 10.1.3.0/24 and your DSL subs are on 192.168.0.0/16
Step 1 - Create the Access Lists necessary to block ICMP from DSL network subs on 192.168.0.0/16 and a rule to implicitly "permit" all other flows.
create access-list BlockPing-to-10.1.1.0 "protocol icmp;icmp-type echo-request;source-address 192.168.0.0/16;destination-address 10.1.1.0/24" "deny"
create access-list BlockPing-to-10.1.2.0 "protocol icmp;icmp-type echo-request;source-address 192.168.0.0/16;destination-address 10.1.2.0/24" "deny"
create access-list BlockPing-to-10.1.3.0 "protocol icmp;icmp-type echo-request;source-address 192.168.0.0/16;destination-address 10.1.3.0/24" "deny"
create access-list Allow-Other-Flows "source-address 0.0.0.0/0;destination-address 0.0.0.0/0" "permit"
All you have done at this point is created the ACL's, you have not applied them to any ports or VLANs yet.
Step 2 - check that your rules have been created.
* X250e-24p.31 # show access-list dynamic
Dynamic Rules: ((*)- Rule is non-permanent )
BlockPing-to-10.1.1.0 Bound to 0 interfaces for application Cli
BlockPing-to-10.1.2.0 Bound to 0 interfaces for application Cli
BlockPing-to-10.1.3.0 Bound to 0 interfaces for application Cli
Allow-Other-Flows Bound to 0 interfaces for application Cli
Bound to 0 interfaces means the rule exists, but is not applied yet. You can check the fully qualified ACL Rule Syntax on a rule by rule basis:
Step 3 - Verify the individual formatted ACLs in ExtremeXOS syntax. This is really just for you to get familiar with ACL Rule Syntax as you would write it in a policy file. If you were going to do more advanced ACLs in the future this may be the better way to go. SO check out Extreme's syntax.
show access-list dynamic rule BlockPing-to-10.1.1.0
show access-list dynamic rule BlockPing-to-10.1.2.0
show access-list dynamic rule BlockPing-to-10.1.3.0
show access-list dynamic rule Allow-Other-Flows
Step 4 - You can apply the rule to specific ports, but in this case, I would just apply to all ports ingress. It's not going to hurt anything. As soon as you enter these commands you are now applying these rules to all interfaces ingress. ICMP's should stop from DSL subs after this. The "first" indicates order. Meaning add this rule to the "first" or top of the ACL precedence order. The "last" indicates order. Add this rule "last" or at the end of the precedence order.
configure access-list add BlockPing-to-10.1.1.0 first any ingress
configure access-list add BlockPing-to-10.1.2.0 first any ingress
configure access-list add BlockPing-to-10.1.3.0 first any ingress
configure access-list add Allow-Other-Flows last any ingress
Step 5 - Verify that your rule order and precedence are being executed in the order that you want them to:
X250e-24p.8 # show access-list any
#Dynamic Entries ((*)- Rule is non-permanent )
RuleNo Name Application Zone Sub-Zone
1 BlockPing-to-10.1.3.0 Cli SYSTEM 0
2 BlockPing-to-10.1.2.0 Cli SYSTEM 0
3 BlockPing-to-10.1.1.0 Cli SYSTEM 0
4 Allow-Other-Flows
Cli SYSTEM
Be sure to run: save config to save your changes after you have created and applied your new ACL.
BACK OUT PROCEDURES> If you need to remove the ACLs for testing you just reverse the order. First you must remove the ACLs from all ports, then you can delete the ACLs after they have been unassigned/removed/deactivated.
Delete Step 1: Unassign/Remove/Deactivate ACL on all ports
configure access-list delete "BlockPing-to-10.1.1.0" all
configure access-list delete "BlockPing-to-10.1.2.0" all
configure access-list delete "BlockPing-to-10.1.3.0" all
configure access-list delete "Allow-Other-Flows" all
Delete Step 2: Delete ACL entries from ExtremeXOS
delete access-list BlockPing-to-10.1.1.0
delete access-list BlockPing-to-10.1.2.0
delete access-list BlockPing-to-10.1.3.0
delete access-list Allow-Other-Flows
Hope that helps you.
