service-exclude protocol (authentication policy rule view)
Function
The service-exclude protocol command excludes a TCP/UDP/SCTP port or IP-layer protocol from a policy rule, so that traffic with the port or IP-layer protocol does not match the policy.
The undo service-exclude protocol command deletes the excluded TCP/UDP/SCTP port or IP-layer protocol from the authentication policy.
Format
# Exclude a TCP/UDP/SCTP port from the authentication policy. If the port is not specified, the default value is TCP, UDP, or SCTP.
service-exclude protocol { { 17 | udp } | { 6 | tcp } | { 132 | sctp } } [ source-port { source-port | start-source-port to end-source-port } &<1-64> | destination-port { destination-port | start-destination-port to end-destination-port } &<1-64> ] *
# Delete the excluded TCP/UDP/SCTP port from an authentication policy.
undo service-exclude protocol { { 17 | udp } | { 6 | tcp } | { 132 | sctp } } [ source-port { source-port | start-source-port to end-source-port } &<1-64> | destination-port { destination-port | start-destination-port to end-destination-port } &<1-64> ] *
# Exclude the ICMP packet type from an authentication policy.
service-exclude protocol { 1 | icmp } [ icmp-type { icmp-name | icmp-type-number { icmp-code-number [ to icmp-code-number ] } &<1-64> } ]
# Delete the excluded ICMP packet type from an authentication policy.
undo service-exclude protocol { 1 | icmp } [ icmp-type { icmp-name | icmp-type-number { icmp-code-number [ to icmp-code-number ] } &<1-64> } ]
# Exclude the ICMPv6 packet type from an authentication policy.
service-exclude protocol { 58 | icmpv6 } [ icmpv6-type { icmpv6-name | icmpv6-type-number { icmpv6-code-number [ to icmpv6-code-number ] } &<1-64> } ]
# Delete the excluded ICMPv6 packet type from an authentication policy.
undo service-exclude protocol { 58 | icmpv6 } [ icmpv6-type { icmpv6-name | icmpv6-type-number { icmpv6-code-number [ to icmpv6-code-number ] } &<1-64> } ]
# Exclude IP-layer protocols except 1-ICMP, 6-TCP, 17-UDP, 58-ICMPv6, and 132-SCTP from an authentication policy. For detailed mappings, refer to the standard IP-layer protocol number list.
service-exclude protocol protocol-number
# Delete the excluded IP-layer protocols except 1-ICMP, 6-TCP, 17-UDP, 58-ICMPv6, and 132-SCTP from an authentication policy.
undo service-exclude protocol protocol-number
Parameters
| Parameter | Description | Value |
|---|---|---|
| 17 | udp | Indicates the User Datagram Protocol (UDP). | - |
| 6 | tcp | Indicates the Transmission Control Protocol (TCP). | - |
| 132 | sctp | Indicates the Stream Control Transmission Protocol (SCTP). | - |
| source-port { source-port | start-source-port to end-source-port } &<1-64> | Specifies the source port or source port range. | The value is an integer ranging from 0 to 65535. A maximum of 64 source ports or source port ranges can be added or deleted at a time. |
| destination-port { destination-port | start-destination-port to end-destination-port } &<1-64> | Specifies the destination port or destination port range. | The value is an integer ranging from 0 to 65535. A maximum of 64 destination ports or destination port ranges can be added or deleted at a time. |
| 1 | icmp | Indicates the Internet Control Message Protocol (ICMP). | - |
| icmp-type | Indicates the ICMP packet type and message code. | - |
| icmp-name | Specifies the ICMP packet type name. | - |
| icmp-type-number { icmp-code-number [ to icmp-code-number ] } &<1-64> | Specifies the ICMP packet type number and message code. | The value is an integer ranging from 0 to 255. A maximum of 64 groups of type numbers and message codes (ranges) can be added or deleted at a time. |
| 58 | icmpv6 | Indicates the Internet Control Message Protocol version 6 (ICMPv6). | - |
| icmpv6-type | Indicates the ICMPv6 packet type and message code. | - |
| icmpv6-name | Specifies the ICMPv6 packet type name. | - |
| icmpv6-type-number { icmpv6-code-number [ to icmpv6-code-number ] } &<1-64> | Specifies the ICMPv6 packet type number and message code. | The value is an integer ranging from 0 to 255. A maximum of 64 groups of type numbers and message codes (ranges) can be added or deleted at a time. |
| protocol-number | Specifies an IP-layer protocol number except 1-ICMP, 6-TCP, 17-UDP, 58-ICMPv6, and 132-SCTP. | The value is an integer ranging from 0 to 255. |
Usage Guidelines
If you reference TCP/UDP/SCTP ports or IP-layer protocols in a policy, you can run the service-exclude protocol command to exclude a port or IP-layer protocol. After the configuration, traffic with the port number or IP-layer protocol will not match the policy.
It is recommended that the configured command contain no more than 500 characters.
Usage Scenario
When configuring a policy, you can reference TCP/UDP/SCTP ports or IP-layer protocols for port-based authentication control. For example, there are services Service1 (TCP, source ports 0-65535, and destination ports 100-120) and Service2 (TCP, source ports 0-65535, and destination ports 100-200). It is required to configure a policy to perform portal authentication on traffic with Service2 but not authenticate traffic with Service1. You can use configuration method 1 in the following table to assign different actions to different ports. This method increases policies as well as policy maintenance workloads. Alternatively, you can use configuration method 2 to run the service-exclude protocol command to configure the policy. This method has the same effect as method 1 and does not need additional policies.
| Configuration Method | Configuration Command |
|---|---|
| Method 1 | <sysname> system-view [sysname] auth-policy [sysname-policy-auth] rule name auth2 [sysname-policy-auth-rule-auth2] service protocol Service1 [sysname-policy-auth-rule-auth2] action none [sysname-policy-auth-rule-auth2] quit [sysname-policy-auth] rule name auth3 [sysname-policy-auth-rule-auth3] service protocol Service2 [sysname-policy-auth-rule-auth3] action auth |
| Method 2 | <sysname> system-view [sysname] auth-policy [sysname-policy-auth] rule name auth3 [sysname-policy-auth-rule-auth3] service-exclude protocol Service1 [sysname-policy-auth-rule-auth3] service protocol Service2 [sysname-policy-auth-rule-auth3] action auth |