PowerScaleOneFS CLI Command Reference

Syntax

isi network firewall rules create <id>  
  [--index <integer>]
  [--description <string>]
  [--protocol (ALL | UDP | TCP | ICMP | ICMP6)]
  [--dst-ports <ports>]
  [--src-networks <ip_address>]
  [--src-ports <ports>]
  [--action (allow | deny | reject)]
  [--live]
  [--verbose | -v]

Options

<id>

Indicates an ID for the new firewall rule. The rule must belong to an existing policy.

The <id> argument is a string that identifies the ID of a firewall rule consisting of a <policy_id> and a rule name, separated by a .. The rule name must be unique to the policy and consist of supported characters, not to exceed 32 characters.

Example: policy1.pool1

--index <integer>

Specifies an index number for this firewall rule.

--description <string>

Specifies a description of the new firewall rule. This string cannot exceed 128 bytes.

--protocol (ALL | UDP | TCP | ICMP | ICMP6)

Indicates the protocol restricted by this firewall rule.

--dst-ports <ports>

Indicates the list of destination network ports that will be restricted by this firewall rule. Specify --dst-ports for each additional network port to restrict.

The <ports> argument specifies the network port by the numeric number or by the service name string. These are the only two variables that can be used in this argument.

--src-networks <ip_address>

Indicates the list of source IP addresses that will be restricted by this firewall rule. Specify --src-networks for each additional source IP address to restrict.

The <ip_address> argument is a string that defines an IPv4 or IPv6 address. IPv4 addresses must be valid IP addresses that are specified in dotted decimal octet format (xxx.xxx.xxx.xxx). IPv6 addresses must be valid IP addresses that are specified in hextets format (xxxx:xxxx:xxxx).

--src-ports <ports>

Indicates the list of source network ports that will be restricted by this firewall rule. Specify --src-ports for each additional network port to restrict.

The <ports> argument specifies the network port by the numeric number or by the service name string. These are the only two variables that can be used in this argument.

--action (allow | deny | reject)

Indicates the default action for this firewall rule. The action allow will allow the network packets. The action deny will discard the network packets. The action reject will send an ICMP unreachable error back to the client.

--live

The --live option is used when issuing a command to create, modify, or delete a rule in an active policy. Changes will take effect immediately on all network subnets and pools associated with this policy.

Using the --live option on an inactive policy will be rejected and will return an error.

--verbose | -v

Displays more detailed information.