16.10 - Example: Secondary Element Processing—Address Range Exception - Teradata Database

Teradata Database Security Administration

Product
Teradata Database
Release Number
16.10
Release Date
June 2017
Content Type
Administration
Security
Publication ID
B035-1100-161K
Language
English (United States)

The secondary element can also specify an exception for a range of IP addresses that are contained within the larger range defined by the primary element.

  • Instead of a single IP address exception, you can deny access to IP addresses for several computers in the company, for example, work stations 141.206.35.192 through 141.206.35.255, with the following deny element:
    <deny ip=“141.206.35.255/

    The deny element is equivalent to the following binary number:

    10001101.11001110.00100011.11111111

    The 255 in the final segment of the deny IP is optional. You can use any number between 192 and 255 to give the same results, based on the mask construction shown in the following bullet.

  • The following mask forces the filter to deny access to all workstations with IP addresses from 141.206.35.192 through 141.206.35.255:
    255.255.255.192”/>

    This mask format indicates that only the last two bits of the fourth segment are significant. If you AND the binary values for the deny IP and the mask, the result shows why you can specify such a wide range of addresses in the forth segment of the deny IP.

    Deny IP  10001101.11001110.00100011.11111111
    Mask     11111111.11111111.11111111.11000000
    ____________________________________________
    Result    10001101.11001110.00100011.11000000

    The mask is equivalent to /26”>, and indicates that the first 26 bits (the bold characters in the result) of the incoming IP address must match the masked deny IP to access to deny the incoming IP address. All IP addresses from 141.206.35.192 through 141.206.35.255 match the bold characters. IP addresses from 141.206.35.1 through 141.206.35.191 have a value of zero for either bit 25 or 26 (or both), do not match all 26 significant binary values, and therefore are not denied.

    The restriction process applies the range of the secondary element, whether it is an allow or a deny, to the binary string from left to right, that is, high to low address. The further to the left you extend the zeros in the mask, the more restrictive the secondary deny. For example, a partial mask of the third segment significantly increases the range addresses affected.