Guidelines for defining IP addresses

Up to 999 records can be specified in a list of IP addresses. The order of ALLOW and FORBID statements is not important.

Define IP addresses using the following guidelines:

• Any IP address or range of addresses that you want to permit, must begin with ALLOW. Any IP address or range of addresses that you want to restrict must begin with FORBID

  Note: ALLOW * and FORBID * are the only valid shorthand entries. All other IP addresses must have 4 segments separated by a period.

• The first statement of the list must always be either ALLOW * or FORBID *. An asterisk in such statement means all addresses or no address. Both ALLOW * and FORBID * statements create the following mask: 0.0.0.0
• If an address matches more than one rule, the rule that is more specific is the one that is applied. The absolute value of a mask as a hexadecimal number determines how specific the rule is. The greater the absolute value of the mask associated with a rule, the more specific it is.

  For example, the IP address 165.4.241.7 matches both of the following rules:

  ALLOW 165.4.*.*        

  FORBID 165.4.240.0,MASK=255.255.240.0

  The rule ALLOW 165.4.*.* has the implicit mask 255.255.0.0 associated with it. The second rule uses the mask 255.255.240.0, which has a higher value, meaning the second rule is more specific. The result is that the connection from IP address 165.4.241.7 will be rejected.

• When an IP address matches multiple rules where no one rule is more specific than the rest, FORBID is applied.

The source format of an IP List is processed at the initialization of IOAGATE (when IOAGATE is started) and when a F IOAGATE,REFRESH=ECAIPLSx modify command is issued to detect syntax errors.

For more information on defining a list of IP addresses, refer to the ECAIPLS Member

Name suffix parameter in Adding Channels.