Configuration Guidelines For Layer 4 Operations - Cisco Catalyst 4500 Series Configuration Manual
Release ios xe 3.3.0sg and ios 15.1(1)sg
Hide thumbs
Also See for Catalyst 4500 Series:
- Software configuration manual (2086 pages) ,
- Administration manual (1814 pages) ,
- Configuration manual (1254 pages)
Table of Contents
Advertisement
Chapter 51
Configuring Network Security with ACLs
Input
Input
Input
Input
Input
Input
Output
Output
Output
Output
Output
Output
Where up to 16 operations are supported, the seventeenth will trigger an expansion.
Note
If you exceed the number of available Layer 4 operations, each new operation might cause the affected
ACE to be translated into multiple ACEs in the hardware. If this translation fails, packets are sent to the
CPU for software processing.
Configuration Guidelines for Layer 4 Operations
When using Layer 4 operators, consider these guidelines:
•
Note
•
Access lists 101 and 102 use the following Layer 4 operations:
OL-25340-01
IPv4
IPv6 Compressed
IPv6 Uncompressed
IPv4
IPv6 Compressed
IPv6 Uncompressed
IPv4
IPv6 Compressed
IPv6 Uncompressed
IPv4
IPv6 Compressed
IPv6 Uncompressed
Layer 4 operations are considered different if the operator or operand differ. For example, the
following ACL contains three different Layer 4 operations because gt 10 and gt 11 are considered
two different Layer 4 operations:
... gt 10 permit
... lt 9 deny
... gt 11 deny
The eq operator can be used an unlimited number of times because eq does not use a Layer 4
operation in hardware.
Layer 4 operations are considered different if the same operator/operand couple applies once to a
source port and once to a destination port, as in the following example:
... Src gt 10....
... Dst gt 10
A more detailed example follows:
access-list 101
... (dst port) gt 10 permit
... (dst port) lt 9 deny
... (dst port) gt 11 deny
... (dst port) neq 6 permit
... (src port) neq 6 deny
... (dst port) gt 10 deny
access-list 102
... (dst port) gt 20 deny
... (src port) lt 9 deny
... (src port) range 11 13 deny
... (dst port) neq 6 permit
Security
16
Security
16
Security
7
QoS
5
QoS
12
QoS
8
Security
17
Security
17
Security
8
QoS
5
QoS
12
QoS
8
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
Layer 4 Operators in ACLs
51-11
- Quick Links:
- Resetting a Switch to Factory Default...
Hide quick links:
Advertisement
Chapters
Table of Contents
Troubleshooting
