You can configure policy rules to match packets based on one or more of the following criteria:
Source IP address, or a range of addresses
Destination IP address, or a range of addresses
IP protocol, such as TCP, UDP, ICMP, or IGMP
Source TCP or UDP port or a range of ports
Destination TCP or UDP port or a range of ports
ICMP type and code
Fragment
DSCP
Use IP wildcards to specify a range of source or destination IP addresses. The zero bits in the wildcard correspond to bits in the IP address that remain fixed. The one bits in the wildcard correspond to bits in the IP address that can vary. Note that this is the opposite of how bits are used in a subnet mask.
For access control lists, you can require the packet to be part of an established TCP session. If the packet is a request for a new TCP session, the packet does not match the rule. You can also specify whether an access control list accepts packets that have an IP option field.
