IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TTL matching

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how IPv4 access control lists (ACLs) match on the Time-to-Live (TTL) value in the IPv4 header.

You can configure ACLs to match on the TTL value specified in the IPv4 header. You can specify the TTL match condition to be based on a single value or on multiple values.

TTL matching is supported for both ingress and egress ACLs.

Table 1. Feature History Table

Feature Name

Release Information

Description

TTL Matching

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on:

  • 88-LC1-48Y8H-EM

TTL Matching

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-4G24Y4H-I

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Configure TTL matching

Use this procedure to configure an IPv4 ACL with TTL match conditions, attach the ACL to an interface, and verify the configuration.

Procedure

  1. Configure an IPv4 ACL with the TTL parameters.

    Example:

    Router(config)# ipv4 access-list acl-v4
Router(config-ipv4-acl)# 10 deny tcp any any ttl eq 100
Router(config-ipv4-acl)# 20 permit tcp any any ttl range 1 50
Router(config-ipv4-acl)# 30 permit tcp any any ttl neq 100
Router(config-ipv4-acl)# commit

  2. Attach the IPv4 ACL to the HundredGigE interface.

    Example:

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 address 15.1.1.1 255.255.255.0
Router(config-if)# ipv4 access-group acl-v4 ingress
Router(config-if)# commit

  3. Verify your configuration by using the show run command.

    Example:

    Router(config)# show run
Building configuration...
!! IOS XR Configuration 0.0.0
!
ipv4 access-list acl-v4
 10 deny tcp any any ttl eq 100
 20 permit tcp any any ttl range 1 50
 30 permit tcp any any ttl neq 100
!
interface HundredGigE 0/0/0/0
 ipv4 address 15.1.1.1 255.255.255.0
 ipv4 access-group acl-v4 ingress
!

    You have successfully configured TTL matching for IPv4 ACLs.