IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

ACL filtering by IP packet length

Updated: September 8, 2026

Want to summarize with AI?

Log in

This topic describes the packet-length filtering feature in access control lists (ACLs) on the Cisco 8000 Series Router.

You can configure an access control list to filter packets by the packet length at an ingress interface. Depending on whether a packet matches the packet-length condition in a permit or deny statement, the packet is either processed or dropped at the interface.

To configure packet-length filtering in an ACL, use the packet-length option in the permit or deny command in IPv4 or IPv6 access-list configuration mode.

Restrictions for ACL filtering by packet length

These restrictions apply to packet-length filtering feature in ACLs:

  • Packet-length filtering is supported only in the ingress direction, for both traditional (non-compression) and hybrid (compression) ACLs.

  • IPv6 packet-length filtering is supported only for hybrid ACLs; not for traditional ACLs.

  • Only quantized (value divisible by 16) packet-length filtering is supported for traditional ACLs on IPv4.

  • For ACLs with compression level 2, by using the hw-module profile tcam format command, you can add packet length as a User Defined Field (UDF) along with src-object-group and dst-object-group as other UDFs.

Configure scaled IPv4 ACLs to filter by packet length

To configure a scaled ACL to filter by packet length in IPv4 networks, use the following steps.

Procedure

  1. Enable packet-length filtering in global configuration mode by using the hw-module command.

    Example:

    Router# configure
Router(config)# hw-module profile tcam format access-list ipv4 src-object-group dst-object-group dst-port proto packet-length frag-bit port-range

  2. Enter global configuration mode and create an object group for configuring a scaled ACL.

    Example:

    Router(config)# object-group network ipv4 netobject1
Router(config-object-group-ipv4)# 50.0.0.0/24
Router(config-object-group-ipv4)# commit

  3. From global configuration mode, configure an IPv4 access list to filter packets by the packet-length value.

    In this example, you configure a statement to process only those packets that match the specified packet-length condition. All other packets are dropped when this ACL is applied to an ingress interface.

    Example:

    Router# configure
Router(config)# ipv4 access-list scaled_acl1
Router(config-ipv4-acl)# 10 permit ipv4 net-group netobject1 any packet-length eq 1000

  4. Commit the ACL and exit the IPv4 ACL configuration mode.

    Example:

    Router(config-ipv4-acl)# commit
Router(config-ipv4-acl)# end

  5. Apply the ACL to the required HundredGigE interface.

    Example:

    Router(config)# interface HundredGigE 0/5/0/3
Router(config-if)# ipv4 access-group scaled_acl1 ingress compress level 2

  6. Commit the configuration and exit the interface configuration mode.

    Example:

    Router(config-if)# commit
Router(config-if)# end

  7. Verify your configuration.

    Example:

    Router# show access-lists scaled_acl1
ipv4 access-list scaled_acl1
10 permit ipv4 net-group netobject1 any packet-length eq 1000

  8. Verify the ACL matches in hardware.

    Example:

    Router# show access-lists scaled_acl1 hardware ingress location 0/5/CPU0
ipv4 access-list scaled_acl1
10 permit ipv4 net-group netobject1 any packet-length eq 1000 (1500 hw matches)

    You have successfully configured a scaled IPv4 ACL to filter by packet length.

Configure scaled IPv6 ACLs to filter by packet length

To configure a scaled ACL to filter by packet length in IPv6 networks, use the following steps.

Procedure

  1. Enable packet-length filtering in global configuration mode by using the hw-module command.

    Example:

    Router# configure
Router(config)# hw-module profile tcam format access-list ipv4 src-object-group dst-object-group dst-port proto packet-length frag-bit port-range

  2. Enter global configuration mode and create an object group for configuring a scaled ACL.

    Example:

    Router(config)# object-group network ipv6 netobject2
Router(config-object-group-ipv6)# 2001::0/128
Router(config-object-group-ipv6)# commit

  3. From global configuration mode, configure a scaled IPv6 access list to filter packets by the packet-length value.

    In this example, you configure a statement to process only those packets that match the specified packet-length condition. All other packets are dropped when this ACL is applied to an ingress interface.

    Example:

    Router(config)# ipv6 access-list scaled_acl2
Router(config-ipv6-acl)# 10 permit ipv6 net-group netobject2 any packet-length eq 1000
Router(config-ipv6-acl)# commit

  4. Commit the ACL and exit the IPv6 ACL configuration mode.

    Example:

    Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# end

  5. Apply the ACL to the required HundredGigE interface.

    Example:

    Router# configure
Router(config)# interface HundredGigE 0/5/0/3
Router(config-if)# ipv6 access-group scaled_acl2 ingress compress level 3

  6. Commit the configuration and exit the interface configuration mode.

    Example:

    Router(config-if)# commit
Router(config-if)# end

  7. Verify your configuration.

    Example:

    Router# show access-lists ipv6 scaled_acl2
ipv6 access-list scaled_acl2
10 permit ipv6 net-group netobject2 any packet-length eq 1000

  8. Verify the ACL matches in hardware.

    Example:

    Router# show access-lists ipv6 scaled_acl2 hardware ingress location 0/5/CPU0
ipv6 access-list scaled_acl2
10 permit ipv6 net-group netobject2 any packet-length eq 1000 (2000 hw matches)

    You have successfully configured a scaled IPv6 ACL to filter by packet length.