destination-address (audit policy rule view)

Function

The destination-address command configures the destination address in an audit policy rule.

The undo destination-address command deletes the destination address from an audit policy rule.

Format

destination-address { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard } [ description description ] | ipv6-address ipv6-prefix-length [ description description ] | range { ipv4-start-address ipv4-end-address | ipv6-start-address ipv6-end-address } [ description description ] | geo-location geo-location-name &<1-6> | geo-location-set geo-location-set-name &<1-6> | mac-address &<1-6> | domain-set domain-set-name &<1-6> | any }

undo destination-address { address-set address-set-name &<1-6> | ipv4-address { ipv4-mask-length | mask mask-address | wildcard } [ description ] | ipv6-address ipv6-prefix-length [ description ] | range { ipv4-start-address ipv4-end-address | ipv6-start-address ipv6-end-address } [ description ] | geo-location geo-location-name &<1-6> | geo-location-set geo-location-set-name &<1-6> | mac-address &<1-6> | domain-set domain-set-name &<1-6> | all }

Parameters

Parameter	Description	Value
address-set-name &<1-6>	Specifies the name of an address or address group.	The specified address or address group must exist. You can configure or delete a maximum of six addresses or address groups at a time.
ipv4-address	Specifies an IPv4 address.	The value is in dotted decimal notation.
ipv4-mask-length	Specifies the mask of an IPv4 address.	The value is an integer ranging from 1 to 32.
mask mask-address	Specifies the mask of an IPv4 address.	The value is in dotted decimal notation whose binary form cannot be inconsecutive. For example, 255.0.255.0 is not a legitimate wildcard because its binary form is 11111111.00000000.11111111.00000000. In the binary form, digits 1 are to be matched, whereas digits 0 are not. For example, 192.168.1.1/255.0.255.0 indicates that only IP addresses of the 192..1. form are to be matched.
wildcard	Specifies the wildcard of an IPv4 address.	The value is in dotted decimal notation whose binary form cannot be inconsecutive. For example, 0.255.0.255 is not a legitimate wildcard because its binary form is 00000000.11111111.00000000.11111111. In the binary form, digits 0 are to be matched, whereas digits 1 are not. For example, 192.168.1.1/0.255.0.255 indicates that only IP addresses of the 192..1. form are to be matched.
description description	Specifies the description of an individual IPv4/IPv6 address or address segment.	The value is a string of 1 to 128 characters.
ipv6-address	Specifies an IPv6 address.	The value is in hexadecimal notation.
ipv6-prefix-length	Specifies the prefix length of an IPv6 address.	The value is an integer ranging from 1 to 128.
range	Indicates an address range.	-
ipv4-start-address	Specifies the start address of an IPv4 address range.	The value is in dotted decimal notation.
ipv4-end-address	Specifies the end address of an IPv4 address range.	The value is in dotted decimal notation.
ipv6-start-address	Specifies the start address of an IPv6 address range.	The value is in hexadecimal notation.
ipv6-end-address	Specifies the end address of an IPv6 address range.	The value is in hexadecimal notation.
geo-location geo-location-name &<1-6>	Specifies the name of a region.	The value must be the name of a predefined region or an existing user-defined region. You can reference or cancel the reference of a maximum of six regions at a time.
geo-location-set geo-location-set-name &<1-6>	Specifies the name of a region group.	The value must be the name of an existing region group. You can reference or cancel the reference of a maximum of six region groups at a time.
mac-address &<1-6>	Specifies a MAC address. All models except USG6680E and USG6712E/6716E support this parameter.	The MAC address can be in one of the following formats: H-H-H (An H is a 4-bit hexadecimal number, such as 00e0 and fc01. If an H contains less than four bits, it means that the first bits contained in the H are 0s. For example, if an H is e0, it is equal to 00e0.) XX:XX:XX:XX:XX:XX (An X is a 1-bit hexadecimal number.) XX-XX-XX-XX-XX-XX (X is a 1-bit hexadecimal number.) The MAC address cannot be all 0s or all Fs (such as FFFF-FFFF-FFFF, 00:00:00:00:00:00, or 00-00-00-00-00-00) in any format. You can add or delete a maximum of six MAC addresses at a time.
domain-set domain-set-name &<1-6>	Specifies the name of a domain group.	The value must be the name of an existing domain group. You can reference or cancel the reference of a maximum of six domain groups at a time. NOTE: When an IP address corresponds to multiple domain names, an IP address can be used to search for a maximum of 16 domain names. If the domain name to be searched is not in the policy rule, the policy cannot be matched. You are advised to configure multiple domain names with the same IP address in the same policy rule.
any	Indicates any destination address.	-
all	Deletes all destination addresses from an audit policy rule.	-

Views

Audit policy rule view

Default Level

2: Configuration level

Usage Guidelines

Regions and region groups are IP address groups. They function like IP addresses or IP address groups. Packets matching any IP address in the specified region or region group match the specified region or region group.

Example

# Set the destination address of audit policy rule policy_audit to 10.1.1.0/24.

<sysname> system-view
[sysname] audit-policy
[sysname-policy-audit] rule name policy_audit
[sysname-policy-audit-rule-policy_audit] destination-address 10.1.1.0 24