17.10 - Example: Secondary Element Processing—Carve Out Exception - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Product
Advanced SQL Engine
Teradata Database
Release Number
17.10
Release Date
July 2021
Content Type
Administration
Security
Publication ID
B035-1100-171K
Language
English (United States)
You can also use the secondary element to specify an exception for a range of IP addresses that are in the midst (rather than at the end) of a larger range defined by the primary element, to carving out a list of denied addresses. This approach also requires use of partial segment masking.
  • You can deny access to IP addresses 48 through 63 (instead of the IP addresses 192 through 255 shown in Example: Secondary Element Processing—Address Range Exception) using the following deny element:
    <deny ip=”141.206.35.48/28”/>

    This deny element is equivalent to the following binary IP and mask:

    10001101.11001110.00100011.00110000 (141.206.35.48)
    11111111.11111110.11111111.11110000 (255.255.255.240 or /28"/>)
    _____________________________________________________________________10001101.11001110.00100011.00110000 (141.206.35.48)
  • The result of ANDing the IP and mask indicates (in bold) that only the first four bits of the fourth segment are considered for denial within the 141.206.35 subnet. These bits must match exactly for an address to be denied. The deny element has the following effects:
    • Addresses 141.206.35.64 through 141.206.35.255 all have a value of 1 for one or both of the first two bits, which causes them to not match the deny mask, and not be denied.
    • Addresses 141.206.35.1 through 141.206.35.47 have a zero value for either the third or fourth bit, and are also not denied.
    • Addresses 141.206.35.48 through 141.206.35.63 all have 0011 for the first four bits, and are denied.
      Because the restriction processes masks from left to right, in binary notation, you cannot isolate some addresses with a carve out type of mask, for example, 141.206.35.51 through 141.206.35.62. Carve out exceptions always affect all addresses that contain the mask value of the IP filter.