IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TCP flags in ACLs

Updated: August 12, 2026

Want to summarize with AI?

This topic describes how TCP flags are used in access control lists (ACLs) to permit or deny packets on the Cisco 8000 Series Router.

The Transmission Control Protocol (TCP) flags are indicators used in ACLs that

influence the flow of data across a TCP connection
provide information about the connection state, and
control packet transfer behavior.

The Transmission Control Protocol (TCP) is one of the most widely used protocols for data transmission in networks. The TCP header contains several one-bit boolean fields known as flags used to influence the flow of data across a TCP connection. TCP packets use TCP flags during a packet transfer to indicate connection state or provide additional information about the packet transfer. This list describes the capabilities of ACLs when filtering packets based on TCP flags:

ACLs allow the creation of Access Control Entries (ACEs) that filter packets based on whether a TCP flag is set or not.
ACLs enable filtering of packets based on the presence or absence of any single TCP flag or a combination of multiple TCP flags.
ACLs provide increased flexibility in packet filtering and enhance security by permitting, for example, packets with a SYN flag to ensure verified sources.

The TCP flags include SYN, ACK, FIN, RST, URG, PSH, and EST, each serving to indicate specific connection states or provide additional packet transfer information.

Feature History Table

Table 1. Feature History Table
Feature Name	Release Information	Description
TCP Flags in Egress IPv6 ACLs	Release 26.2.1	Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):* *This feature is supported on: 88-LC1-48Y8H-EM
TCP Flags in Egress IPv6 ACLs	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
TCP Flags in Egress IPv6 ACLs	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
TCP Flags in Egress IPv6 ACLs	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
TCP Flags in Egress IPv6 ACLs	Release 7.3.15	You can configure an egress IPv6 ACL that permits or denies packets on the basis of TCP flags set in them. Through this feature, you can restrict and manage traffic streams thereby enhancing network security. The following commands are updated: deny (IPv6) permit (IPv6)

TCP flags

This section lists the TCP flags that can be present in a packet.

The following TCP flags can be present in a packet:

SYN: Both the sender and receiver devices use the synchronization (SYN) flag in only the first packet that is sent.
ACK: The receiver devices use the acknowledgment (ACK) flag in the packet that is sent to acknowledge the successful receipt of a packet.
FIN: The sender device uses the finished (FIN) flag in the last packet to indicate that there is no more data to be sent.
RST: The receiver device uses the reset (RST) flag in the packet sent to the sender device when the receiver device receives a packet that is not expected.
URG: The sender device uses the urgent (URG) flag in the packets to notify the receiver device to process the urgent packets before processing all other packets.
PSH: The receiver device uses the push (PSH) flag that is similar to the URG flag and tells the receiver to process these packets as soon as they are received without waiting for any other packets to be received.
EST: When a remote host receives TCP packets with a SYN flag set and if it does not support such a service, the remote host replies with an EST flag set in the packet. EST flag signifies both ACK and RST flags set in the packet.

Configuration guidelines and restrictions for ACLs based on TCP flags

The following restrictions apply when you configure ACLs based on TCP flags:

Before Release 7.3.15, you cannot filter egress IPv6 packets based on TCP flags.

The following guidelines apply when you configure ACLs based on TCP flags:

You must configure the PBR policy to explicitly match the TCP protocol along with the required TCP flags in the class-map to ensure precise traffic classification and prevent unintended redirection.

Configure ACLs based on TCP flags

Use this procedure to configure an ACL that filters packets based on TCP flags. Use the match-any keyword to permit or deny packets based on whether any of the configured TCP flags is set. Use the match-all keyword to permit or deny packets based on whether all the configured TCP flags are set.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create an IPv4 ACL named ACL-TCP.

Example:

Router(config)# ipv4 access-list ACL-TCP

Configure an ACE using the match-any keyword to permit packets based on the required TCP flags, and commit the configuration.

The following example shows how to permit packets that have either the PSH or URG TCP flags set:
Example:
```
Router(config-ipv4-acl)# 10 permit tcp any any match-any + urg + psh
Router(config-ipv4-acl)# commit
```
The following example shows how to permit packets that have either the SYN or ACK TCP flag set:
Example:
```
Router(config-ipv4-acl)# 10 permit tcp any any match-any + syn + ack
Router(config-ipv4-acl)# commit
```
The following example shows how to permit packets that have the SYN flag set or the ACK flag not set:
Example:
```
Router(config-ipv4-acl)# 10 permit tcp any any match-any + syn - ack
Router(config-ipv4-acl)# commit
```
Configure an ACE using the match-all keyword to permit packets based on the required TCP flags, and commit the configuration.

The following example shows how to permit packets that have both the URG flag and FIN flag set:
Example:
```
Router(config-ipv4-acl)# 10 permit tcp any any match-all + urg + fin
Router(config-ipv4-acl)# commit
```
The following example shows how to permit packets that have both the SYN flag set and the ACK flag not set:
Example:
```
Router(config-ipv4-acl)# 10 permit tcp any any match-all + syn - ack
Router(config-ipv4-acl)# commit
```
You have successfully configured an ACL based on TCP flags.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.