Cisco IE-3000-8TC Software Configuration Manual page 640
Software configuration guide
Hide thumbs
Also See for IE-3000-8TC:
- Command reference manual (802 pages) ,
- Administration manual (496 pages) ,
- Message manual (98 pages)
Table of Contents
Advertisement
Configuring IPv4 ACLs
Command
or
access-list access-list-number
{deny | permit} protocol
host source host destination
[precedence precedence] [tos tos]
[fragments] [time-range
time-range-name] [dscp dscp]
Step
access-list access-list-number
2b
{deny | permit} tcp source
source-wildcard [operator port]
destination destination-wildcard
[operator port] [established]
[precedence precedence] [tos tos]
[fragments] [time-range
time-range-name] [dscp dscp]
[flag]
Step
access-list access-list-number
2c
{deny | permit} udp
source source-wildcard [operator
port] destination
destination-wildcard [operator
port] [precedence precedence]
[tos tos] [fragments] [time-range
time-range-name] [dscp dscp]
Cisco IE 3000 Switch Software Configuration Guide
34-10
Purpose
Define an extended IP access list by using an abbreviation for a source and a
source wildcard of source 0.0.0.0 and an abbreviation for a destination and
destination wildcard of destination 0.0.0.0.
You can use the host keyword in place of the source and destination wildcard
or mask.
(Optional) Define an extended TCP access list and the access conditions.
Enter tcp for Transmission Control Protocol.
The parameters are the same as those described in Step 2a, with these
exceptions:
(Optional) Enter an operator and port to compare source (if positioned after
source source-wildcard) or destination (if positioned after destination
destination-wildcard) port. Possible operators include eq (equal), gt (greater
than), lt (less than), neq (not equal), and range (inclusive range). Operators
require a port number (range requires two port numbers separated by a space).
Enter the port number as a decimal number (from 0 to 65535) or the name of a
TCP port. To see TCP port names, use the ? or see the "Configuring IP Services"
section in the "IP Addressing and Services" chapter of the Cisco IOS IP
Configuration Guide, Release 12.2. Use only TCP port numbers or names when
filtering TCP.
The other optional keywords have these meanings:
established—Enter to match an established connection. This has the same
•
function as matching on the ack or rst flag.
•
flag—Enter one of these flags to match by the specified TCP header bits:
ack (acknowledge), fin (finish), psh (push), rst (reset), syn (synchronize),
or urg (urgent).
(Optional) Define an extended UDP access list and the access conditions.
Enter udp for the User Datagram Protocol.
The UDP parameters are the same as those described for TCP except that the
[operator [port]] port number or name must be a UDP port number or name, and
the flag and established parameters are not valid for UDP.
Chapter 34
Configuring Network Security with ACLs
OL-13018-03
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
