17.10 - Example: Secondary Element Processing—Carve Out Exception - Advanced SQL Engine - Teradata Database

Teradata Vantage™ - Advanced SQL Engine Security Administration

Advanced SQL Engine
Teradata Database
Release Number
July 2021
English (United States)
Last Update
You can also use the secondary element to specify an exception for a range of IP addresses that are in the midst (rather than at the end) of a larger range defined by the primary element, to carving out a list of denied addresses. This approach also requires use of partial segment masking.
  • You can deny access to IP addresses 48 through 63 (instead of the IP addresses 192 through 255 shown in Example: Secondary Element Processing—Address Range Exception) using the following deny element:
    <deny ip=””/>

    This deny element is equivalent to the following binary IP and mask:

    10001101.11001110.00100011.00110000 (
    11111111.11111110.11111111.11110000 ( or /28"/>)
    _____________________________________________________________________10001101.11001110.00100011.00110000 (
  • The result of ANDing the IP and mask indicates (in bold) that only the first four bits of the fourth segment are considered for denial within the 141.206.35 subnet. These bits must match exactly for an address to be denied. The deny element has the following effects:
    • Addresses through all have a value of 1 for one or both of the first two bits, which causes them to not match the deny mask, and not be denied.
    • Addresses through have a zero value for either the third or fourth bit, and are also not denied.
    • Addresses through all have 0011 for the first four bits, and are denied.
      Because the restriction processes masks from left to right, in binary notation, you cannot isolate some addresses with a carve out type of mask, for example, through Carve out exceptions always affect all addresses that contain the mask value of the IP filter.