IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Configure a hybrid ACL

Updated: August 12, 2026

Want to summarize with AI?

This topic describes the prerequisites and restrictions for configuring an hybrid or hyrid ACL.

You can configure two types of hybrid ACLs:

Before you begin

You must be aware of this information that apply to hybrid ACLs:

You can configure ACLs that contain both conventional and hybrid ACEs.
You can modify the objects in an object group dynamically without redefining the object group or the ACE that references the object group.
You can configure an hybrid ACL multiple times with a source group, or a destination group, or both source and destination groups.

Configure a network hybrid ACL for compress level 1 for IPv4 address

Use this procedure to configure a network hybrid ACL that applies Compress Level 1 to an IPv4 address on a HundredGigE interface.

Note

Compress Level 1 supports prefix masks /n, not arbitrary address masks a.b.c.d.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create a network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv4 netobj1
Router(config-object-group-ipv4)# description my-network-object
Router(config-object-group-ipv4)# host 10.1.1.1
Router(config-object-group-ipv4)# 10.2.1.0 255.255.255.0
Router(config-object-group-ipv4)# range 10.3.1.10 10.3.1.50

Create an IPv4 access list that references the object group.

Example:

Router(config)# ipv4 access-list network-object-acl permit ipv4 net-group netobj1 any

Apply the access list to a HundredGigE interface with compress level 1 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv4 address 1.1.1.1/24
Router(config-if)# no shut
Router(config-if)# ipv4 access-group network-object-acl ingress compress level 1
Router(config-if)# commit
Router(config-if)# exit

Verify the configuration by using the show run command.

Example:

Router(config)# show run
Tue Mar 28 10:37:55.737 IST

Building configuration...
!! IOS XR Configuration 0.0.0
...

!
object-group network ipv4 netobj1
 10.2.1.0/24
 host 10.1.1.1
 range  10.3.1.10 10.3.1.50
 description my-network-object
!
!
ipv4 access-list network-object-acl
 10 permit ipv4 net-group netobj1 any
!
interface HundredGigE 0/0/10/3
 ipv4 address 1.1.1.1 255.255.255.0
 ipv4 access-group network-object-acl ingress compress level 1
!

You have successfully configured a network hybrid ACL for Compress Level 1 for an IPv4 address.

Configure a network hybrid ACL for compress level 1 for IPv6 address

Use this procedure to configure a network hybrid ACL that applies Compress Level 1 to an IPv6 address on a HundredGigE interface.

Note

Compress Level 1 supports prefix masks /n, not arbitrary address masks a.b.c.d.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create a network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv6 netobj1
Router(config-object-group-ipv6)# description my-network-object
Router(config-object-group-ipv6)# host 2001:DB8:1::1
Router(config-object-group-ipv6)# 2001:DB8::1 2001:DB8:0:ABCD::1
Router(config-object-group-ipv6)# range 2001:DB8::2 2001:DB8::5

Create an IPv6 access list that references the object group.

Example:

Router(config)# ipv6 access-list network-object-acl permit ipv6 net-group netobj1 any

Apply the access list to a HundredGigE interface with compress level 1 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv6 address 2001:DB8::1/32
Router(config-if)# no shut
Router(config-if)# ipv6 access-group network-object-acl ingress compress level 1
Router(config-if)# commit
Router(config-if)# exit

You have successfully configured a network hybrid ACL for Compress Level 1 for an IPv6 address.

Configure a network hybrid ACL for compress level 2 for IPv4 address

Use this procedure to configure a network hybrid ACL that applies Compress Level 2 to an IPv4 address on a HundredGigE interface.

Note

Compress Level 2 supports prefix masks /n, not arbitrary address masks a.b.c.d.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create a network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv4 netobj1
Router(config-object-group-ipv4)# description my-network-object
Router(config-object-group-ipv4)# host 10.1.1.1
Router(config-object-group-ipv4)# 10.2.1.0 255.255.255.0
Router(config-object-group-ipv4)# range 10.3.1.10 10.3.1.50

Create an IPv4 access list that references the object group.

Example:

Router(config)# ipv4 access-list network-object-acl permit ipv4 net-group netobj1 any

Apply the access list to a HundredGigE interface with compress level 2 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv4 address 1.1.1.1/24
Router(config-if)# no shut
Router(config-if)# ipv4 access-group network-object-acl ingress compress level 2
Router(config-if)# commit
Router(config-if)# exit

Verify the configuration by using the show run command.

Example:

Router(config)# show run
Tue Mar 28 10:37:55.737 IST

Building configuration...
!! IOS XR Configuration 0.0.0
...

!
object-group network ipv4 netobj1
 10.2.1.0/24
 host 10.1.1.1
 range  10.3.1.10 10.3.1.50
 description my-network-object
!
!
ipv4 access-list network-object-acl
 10 permit ipv4 net-group netobj1 any
!
interface HundredGigE 0/0/10/3
 ipv4 address 1.1.1.1 255.255.255.0
 ipv4 access-group network-object-acl ingress compress level 2
!

You have successfully configured a network hybrid ACL for Compress Level 2 for an IPv4 address.

Configure a network hybrid ACL for compress level 2 for IPv6 address

Use this procedure to configure a network hybrid ACL that applies Compress Level 2 to an IPv6 address on a HundredGigE interface.

Note

Compress Level 2 supports prefix masks /n, not arbitrary address masks a.b.c.d.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create a network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv6 netobj1
Router(config-object-group-ipv6)# description my-network-object
Router(config-object-group-ipv6)# host 2001:DB8:1::1
Router(config-object-group-ipv6)# 2001:DB8::1 2001:DB8:0:ABCD::1
Router(config-object-group-ipv6)# range 2001:DB8::2 2001:DB8::5

Create an IPv6 access list that references the object group.

Example:

Router(config)# ipv6 access-list network-object-acl permit ipv6 net-group netobj1 any

Apply the access list to a HundredGigE interface with compress level 2 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv6 address 2001:DB8::1/32
Router(config-if)# no shut
Router(config-if)# ipv6 access-group network-object-acl ingress compress level 2
Router(config-if)# commit
Router(config-if)# exit

You have successfully configured a network hybrid ACL for Compress Level 2 for an IPv6 address.

Verify source prefix for an egress network hybrid ACL for compress level 2

Use this procedure after you configure an IPv4 or IPv6 ACL with Compress Level 2 to verify that the source prefix is captured in the TCAM.

Procedure

Verify the source prefix for the egress network hybrid ACL by using the show access-lists command with the hardware egress verify location options.

In the following example, the SRC IP prefix type records 2 entries for the network-object-acl ACL.

Example:

Router# show access-lists network-object-acl hardware egress verify location 0/0/cpu0
Verifying TCAM entries for network-object-acl
Please wait...
INTF    NPU lookup  ACL # intf Total  compression Total   result failed(Entry) TCAM entries
                type    ID  shared ACES   prefix-type Entries        ACE SEQ #     verified
 ---------- --- ------- --- ------ ------ ----------- ------- ------ ------------- ------------

HundredGigE0_0_0_0 (ifhandle: 0x130)

              0 IPV4      1      1      2 COMPRESSED        2 passed                          2
                                          SRC IP            2 passed                          2
                                          DEST IP           2 passed                          2
                                          SRC PORT          0 passed                          0

You have successfully verified the source prefix for an egress network hybrid ACL with Compress Level 2.

Verify TCAM usage for IPv4 and IPv6 ACLs

Use this procedure to verify TCAM resource utilization for IPv4 and IPv6 ACLs, and to confirm the location of the source and destination prefixes.

Table 1. TCAM utilization for IPv4 and IPv6 ACLs
ACL	Source Prefix Location	Destination Prefix Location
IPv4	narrow_1 band	narrow_0 band. The ACEs are stored in the narrow_0 band.
IPv6	narrow_1 band	narrow_0 band. ACEs are stored in the wide band.

Procedure

Verify TCAM resource utilization for IPv4 and IPv6 ACLs by using the show controllers npu resource egressacltcam location command.

Example:

/* This is a sample for IPv4 ACLs that captures narrow_1 and narrow_0 band for source and destination prefixes. */

Router#show controllers npu resources egressacltcam location$
Wed Jan  8 07:53:02.101 UTC
HW Resource Information
    Name                            : egress_acl_tcam
    Asic Type                       : Q200
    Insight exported timestamp      : 2025.Jan.08 07:52:58 UTC

NPU-0
OOR Summary
        Red Threshold               : 95 %
        Yellow Threshold            : 80 %



Current Hardware Usage
    Name: egress_acl_tcam


       Name: narrow_0


           Name: slice_0
Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_1
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_2
               Estimated Max Entries       : 9728
               Total In-Use                : 4        (0 %)
               High Water Mark             : 4
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


       Name: narrow_1


           Name: slice_0
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_1
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_2
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


       Name: wide


           Name: slice_0
               Estimated Max Entries       : 5118
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 5118
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 5116
               Total In-Use                : 0        (0 %)



NPU-1
OOR Summary
        Red Threshold               : 95 %
        Yellow Threshold            : 80 %



Current Hardware Usage
    Name: egress_acl_tcam


       Name: narrow_0


           Name: slice_0
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


       Name: narrow_1


           Name: slice_0
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


       Name: wide


           Name: slice_0
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)

Example:

This is a sample for IPv6 ACLs that captures narrow_1 and narrow_0 band for source and destination prefixes.


Router#show controllers npu resources egressacltcam locatio$
Wed Jan  8 07:59:15.111 UTC
HW Resource Information
    Name                            : egress_acl_tcam
    Asic Type                       : Q200
    Insight exported timestamp      : 2025.Jan.08 07:58:58 UTC

NPU-0
OOR Summary
        Red Threshold               : 95 %
        Yellow Threshold            : 80 %



Current Hardware Usage
    Name: egress_acl_tcam


       Name: narrow_0


           Name: slice_0
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_1
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_2
               Estimated Max Entries       : 9724
               Total In-Use                : 2        (0 %)
               High Water Mark             : 4
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


       Name: narrow_1


           Name: slice_0
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_1
               Estimated Max Entries       : 9728
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


           Name: slice_2
               Estimated Max Entries       : 9724
               Total In-Use                : 2        (0 %)
               High Water Mark             : 2
               High Water Mark Time        : 2025.Jan.08 07:52:52 UTC


       Name: wide


           Name: slice_0
               Estimated Max Entries       : 5118
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 5118
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 5118
               Total In-Use                : 4        (0 %)
               High Water Mark             : 4
               High Water Mark Time        : 2025.Jan.08 07:58:52 UTC



NPU-1
OOR Summary
        Red Threshold               : 95 %
        Yellow Threshold            : 80 %



Current Hardware Usage
    Name: egress_acl_tcam


       Name: narrow_0


           Name: slice_0
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


       Name: narrow_1


           Name: slice_0
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 10240
               Total In-Use                : 0        (0 %)


       Name: wide


           Name: slice_0
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)


           Name: slice_1
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)


           Name: slice_2
               Estimated Max Entries       : 5120
               Total In-Use                : 0        (0 %)

For IPv4 ACLs, verify that the source prefixes are captured in narrow_1 , and that the narrow_0 band captures the destination prefix and ACEs.
For IPv6 ACLs, verify that the source prefix is captured in the narrow_1 band, the destination prefix is captured in the narrow_0 band, and the ACEs are captured in the wide band.

You have successfully verified TCAM usage for IPv4 and IPv6 ACLs.

Configure a network hybrid ACL for compress level 4

Use this procedure to configure a network object-group ACL that applies Compress Level 4 to IPv4 and IPv6 addresses on a HundredGigE interface.

Note

Compress Level 4 supports prefix masks /n, not arbitrary address masks a.b.c.d.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create an IPv4 network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv4 netobj1
Router(config-object-group-ipv4)# description my-network-object
Router(config-object-group-ipv4)# host 10.1.1.1
Router(config-object-group-ipv4)# 10.2.1.0 255.255.255.0
Router(config-object-group-ipv4)# range 10.3.1.10 10.3.1.50

Create an IPv4 access list that references the object group.

Example:

Router(config)# ipv4 access-list network-object-acl permit ipv4 net-group netobj1 any

Apply the IPv4 access list to a HundredGigE interface with compress level 4 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv4 address 1.1.1.1/24
Router(config-if)# no shut
Router(config-if)# ipv4 access-group network-object-acl ingress compress level 4
Router(config-if)# commit
Router(config-if)# exit

Create an IPv6 network object group named netobj1 and add host, network, and range entries.

Example:

Router(config)# object-group network ipv6 netobj1
Router(config-object-group-ipv6)# description my-network-object
Router(config-object-group-ipv6)# host 2001:DB8:1::1
Router(config-object-group-ipv6)# 2001:DB8::1 2001:DB8:0:ABCD::1
Router(config-object-group-ipv6)# range 2001:DB8::2 2001:DB8::5

Create an IPv6 access list that references the object group.

Example:

Router(config)# ipv6 access-list network-object-acl permit ipv6 net-group netobj1 any

Apply the IPv6 access list to a HundredGigE interface with compress level 4 and commit the configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv6 address 2001:DB8::1/32
Router(config-if)# no shut
Router(config-if)# ipv6 access-group network-object-acl ingress compress level 4
Router(config-if)# commit
Router(config-if)# exit

Verify the configuration by using the show run command.

Example:

Router(config)# show run
Tue Mar 28 10:37:55.737 IST

Building configuration...
!! IOS XR Configuration 0.0.0
...

!
object-group network ipv4 netobj1
 10.2.1.0/24
 host 10.1.1.1
 range  10.3.1.10 10.3.1.50
 description my-network-object
!
!
ipv4 access-list network-object-acl
 10 permit ipv4 net-group netobj1 any
!
interface HundredGigE 0/0/10/3
 ipv4 address 1.1.1.1 255.255.255.0
 ipv4 access-group network-object-acl ingress compress level 4
!

You have successfully configured a network object-group ACL for Compress Level 4.

Configure user-defined TCAM keys for IPv4 and IPv6 for compress levels 1 and 4

Use this procedure to define UDKs for IPv4 and IPv6 for Compress Level 1 and Compress Level 4.

Before you begin

Modification for UDK is not supported using the hw-module profile tcam format command.
First, remove the existing UDK using the no hw-module profile tcam format command, then add a new UDK definition.
Make sure that you reload the line card for the UDK configuration to take effect.
If you configure UDK, you cannot use the default keys. But you can explicitly define the default fields in UDK.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Define the UDK for IPv4 and IPv6 for Compress Level 1.

Example:

Router(config)# hw-module profile tcam format access-list ipv4 src-object-group src-port dst-port proto tcp-flags frag-bit dst-addr
Router(config)# hw-module profile tcam format access-list ipv6 src-object-group src-port dst-port next-hdr frag-bit tcp-flags dst-addr

Define the UDK for IPv4 and IPv6 for Compress Level 4.

Example:

Router(config)# hw-module profile tcam format access-list ipv4 src-addr src-port dst-port proto tcp-flags frag-bit dst-object-group
Router(config)# hw-module profile tcam format access-list ipv6 src-addr src-port dst-port next-hdr frag-bit tcp-flags dst-object-group

Manually reload the node on the line card for the UDK configuration to take effect.
Configure the ACL using the fields defined in the UDK, and attach the ACL to an interface in the ingress direction.

You have successfully configured User-Defined TCAM Keys for IPv4 and IPv6 for Compress Levels 1 and 4.

Configure an egress IPv4 or IPv6 hybrid ACL on a HundredGigE Interface

From Release 7.10.1 onwards, you can configure an egress IPv4 or IPv6 hybrid ACL on an interface in Q200 ASIC based systems. This allows you to separate address prefixes and ports into two object groups or access control entries (ACEs), which improves network traffic security and allows better use of space and resources to accommodate more ACLs.

Use this procedure to configure an egress IPv4 hybrid ACL on a HundredGigE interface. You can configure an egress IPv6 hybrid ACL by using the same steps with IPv6 syntax.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create a network object group named netobj1 and commit the configuration.

Example:

Router(config)# object-group network ipv4 netobj1
Router(config-object-group-ipv4)# 12.1.0.0/16
Router(config-object-group-ipv4)# 14.1.0.0/16
Router(config-object-group-ipv4)# 105.2.0.0/16
Router(config-object-group-ipv4)# commit

Create an IPv4 access list named test-v4 that references the object group, and commit the configuration.

Example:

Router(config)# ipv4 access-list test-v4
Router(config-ipv4-acl)# 10 deny ipv4 any net-group netobj1
Router(config-ipv4-acl)# 20 permit ipv4 any any
Router(config-ipv4-acl)# commit

Apply the access list to a HundredGigE interface with the appropriate compression level and commit the configuration.

The following example applies the access list with compress level 1 .

Example:

Router(config)# interface fourHundredGigE 0/0/0/1
Router(config-if)# ipv4 access-group test-v4 egress compress level 1
Router(config-if)# commit

The following example applies the access list with compress level 2 .

Example:

Router(config)# interface fourHundredGigE 0/0/0/1
Router(config-if)# ipv4 access-group test-v4 egress compress level 2
Router(config-if)# commit

The following example applies the access list with compress level 4 .

Example:

Router(config)# interface fourHundredGigE 0/0/0/1
Router(config-if)# ipv4 access-group test-v4 egress compress level 4
Router(config-if)# commit

Verify the running configuration for the network object group, access list, and interface by using the show running-config command.

Example:

Router# show running-config object-group network ipv4 netobj1
Tue Jul 25 22:44:20.516 UTC
object-group network ipv4 netobj1
12.1.0.0/16
14.1.0.0/16
105.2.0.0/16
!

Router# show running-config ipv4 access-list test-v4
Tue Jul 25 22:44:39.010 UTC
ipv4 access-list test-v4
10 deny ipv4 any net-group netobj1
20 permit ipv4 any any
!

Router# show running-config interface fourHundredGigE 0/0/0/1
Tue Jul 25 22:45:13.769 UTC
interface FourHundredGigE0/0/0/1
ipv4 address 12.1.0.1 255.255.255.0
ipv6 address 12:1::1/64
ipv4 access-group test-v4 egress compress level 1
!

Verify the packet count for the filtered traffic by using the show access-lists ipv4 hardware egress location command.
Example:
```
Router# show access-lists ipv4 test-v4 hardware egress location 0/RP0/CPU0
Tue Jul 25 22:53:38.980 UTC
ipv4 access-list test-v4
10 deny ipv4 any net-group netobj1 (47 matches)
20 permit ipv4 any any (100008 matches)
```
You have successfully configured an egress IPv4 or IPv6 hybrid ACL on a HundredGigE interface. The filtered packet count in the example is 47 and 100008, which implies that traffic is filtered according to the rules in the ACL.

Configure a port object-group ACL

A port object-group can contain a single or multiple port objects.

Before you begin

If you configure port object-group ACLs with compression level 2, it does not result in a lower number of TCAM entries because the compression algorithm only uses the source and destination prefixes and not the port or protocol numbers.

Procedure

From the global configuration mode, create a port object group, and commit your configuration.

Example:

Router(config)# object-group port portobj1
Router(config-object-group-ipv4)# description my-port-object
Router(config-object-group-ipv4)# eq bgp
Router(config-object-group-ipv4)# range 100 200
Router(config-object-group-ipv4)# commit
Router(config-object-group-ipv4)# exit

Create an access list referencing the object group.

Example:

Router(config)# ipv4 access-list port-object-acl permit ipv4 net-group portobj1

Apply the access list containing the object group to the desired interface and commit your configuration.

Example:

Router(config)# interface HundredGigE 0/0/10/3
Router(config-if)# ipv4 address 2.2.2.2/24
Router(config-if)# ipv4 access-group port-obj-acl ingress compress level 2
Router(config-if)# no shut
Router(config-if)# commit
Tue Mar 28 10:23:34.106 IST

Router(config-if)# interface HundredGigE 0/0/10/3, changed state to Down
Router(config-if)# interface HundredGigE 0/0/10/3, changed state to Up

Router(config-if)# exit

Confirm your configuration.

Router(config)# show run
Tue Mar 28 10:37:55.737 IST

Building configuration...
!! IOS XR Configuration 0.0.0
...
object-group port portobj1
 eq bgp
 range 100 200
!
ipv4 access-list port-object-acl
 10 permit tcp net-group portobj1
!
interface HundredGigE 0/0/10/3
 ipv4 access-group port-obj-acl ingress compress level 2
!
end
!

You have successfully configured a port object-group ACL.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.