Usage Guidelines
When the device applies an IPv4 ACL to a packet, it evaluates the
packet with every rule in the ACL. The device enforces the first rule that has
conditions that are satisfied by the packet. When the conditions of more than
one rule are satisfied, the device enforces the rule with the lowest sequence
number.
This command does not require a license.
Protocol
You can specify the protocol of packets that the rule applies to by
the protocol name or the number of the protocol. If you want the rule to apply
to all IPv4 traffic, use the
ip keyword.
The protocol keyword that you specify affects the additional keywords
and arguments that are available. Unless otherwise specified, only the other
keywords that apply to all IPv4 protocols are available. Those keywords include
the following:
-
- dscp
- fragments
- log
- packet-length
- precedence
- time-range
Valid protocol numbers are from 0 to 255.
Valid protocol names are the following keywords:
- ahp —Specifies that the rule applies to
authentication header protocol (AHP) traffic only.
- eigrp —Specifies that the rule applies to
Enhanced Interior Gateway Routing Protocol (EIGRP) traffic only.
- esp —Specifies that the rule applies to
Encapsulating Security Protocol (ESP) traffic only.
- gre —Specifies that the rule applies to
General Routing Encapsulation (GRE) traffic only.
- icmp —Specifies that the rule applies to
ICMP traffic only. When you use this keyword, the
icmp-message argument is available, in
addition to the keywords that are available for all valid values of the
protocol argument.
- igmp —Specifies that the rule applies to
IGMP traffic only. When you use this keyword, the
igmp-type argument is available, in
addition to the keywords that are available for all valid values of the
protocol argument.
- ip —Specifies that the rule applies to all
IPv4 traffic.
- nos —Specifies that the rule applies to
KA9Q NOS-compatible IP-over-IP tunneling traffic only.
- ospf —Specifies that the rule applies to
Open Shortest Path First (OSPF) traffic only.
- pcp —Specifies that the rule applies to
payload compression protocol (PCP) traffic only.
- pim —Specifies that the rule applies to
protocol-independent multicast (PIM) traffic only.
- tcp —Specifies that the rule applies to
TCP traffic only. When you use this keyword, the
flags and
operator arguments and the
portgroup and
established keywords are available, in
addition to the keywords that are available for all valid values of the
protocol argument.
- udp —Specifies that the rule applies to
UDP traffic only. When you use this keyword, the
operator argument and the
portgroup keyword are available, in
addition to the keywords that are available for all valid values of the
protocol argument.
Source and Destination
You can specify the
source and
destination arguments in one of several ways.
In each rule, the method you use to specify one of these arguments does not
affect how you specify the other. When you configure a rule, use the following
methods to specify the
source and
destination arguments:
- IP address group object—You can use an IPv4 address group object
to specify a
source or
destination argument. Use the
object-group
ip
address command to create and change IPv4
address group objects. The syntax is as follows:
addrgroup
address-group-name
The following example shows how to use an IPv4 address object group
named lab-gateway-svrs to specify the
destination argument:
switch(config-acl)# permit ip any addrgroup lab-gateway-svrs
- Address and network wildcard—You can use an IPv4 address followed
by a network wildcard to specify a host or a network as a source or
destination. The syntax is as follows:
IPv4-address network-wildcard
The following example shows how to specify the
source argument with the IPv4 address and
network wildcard for the 192.168.67.0 subnet:
switch(config-acl)# permit tcp 192.168.67.0 0.0.0.255 any
- Address and variable-length subnet mask—You can use an IPv4
address followed by a variable-length subnet mask (VLSM) to specify a host or a
network as a source or destination. The syntax is as follows:
IPv4-address/prefix-len
The following example shows how to specify the
source argument with the IPv4 address and
VLSM for the 192.168.67.0 subnet:
switch(config-acl)# permit udp 192.168.67.0/24 any
- Host address—You can use the
host keyword and an IPv4 address to specify
a host as a source or destination. The syntax is as follows:
host
IPv4-address
This syntax is equivalent to
IPv4-address /32 and
IPv4-address 0.0.0.0.
The following example shows how to specify the
source argument with the
host keyword and the 192.168.67.132 IPv4
address:
switch(config-acl)# permit icmp host 192.168.67.132 any
- Any address—You can use the
any keyword to specify that a source or
destination is any IPv4 address. For examples of the use of the
any keyword, see the examples in this
section. Each example shows how to specify a source or destination by using the
any keyword.
ICMP Message Types
The
icmp-message argument can be one of the
following keywords:
- administratively-prohibited —Administratively
prohibited
- alternate-address —Alternate address
- conversion-error —Datagram conversion
- dod-host-prohibited —Host prohibited
- dod-net-prohibited —Net prohibited
- echo —Echo (ping)
- echo-reply —Echo reply
- general-parameter-problem —Parameter
problem
- host-isolated —Host isolated
- host-precedence-unreachable —Host
unreachable for precedence
- host-redirect —Host redirect
- host-tos-redirect —Host redirect for ToS
- host-tos-unreachable —Host unreachable for
ToS
- host-unknown —Host unknown
- host-unreachable —Host unreachable
- information-reply —Information replies
- information-request —Information requests
- mask-reply —Mask replies
- mask-request —Mask requests
- mobile-redirect —Mobile host redirect
- net-redirect —Network redirect
- net-tos-redirect —Net redirect for ToS
- net-tos-unreachable —Network unreachable
for ToS
- net-unreachable —Net unreachable
- network-unknown —Network unknown
- no-room-for-option —Parameter required but
no room
- option-missing —Parameter required but not
present
- packet-too-big —Fragmentation needed and
DF set
- parameter-problem —All parameter problems
- port-unreachable —Port unreachable
- precedence-unreachable —Precedence cutoff
- protocol-unreachable —Protocol unreachable
- reassembly-timeout —Reassembly timeout
- redirect —All redirects
- router-advertisement —Router discovery
advertisements
- router-solicitation —Router discovery
solicitations
- source-quench —Source quenches
- source-route-failed —Source route failed
- time-exceeded —All time exceeded messages
- timestamp-reply —Timestamp replies
- timestamp-request —Timestamp requests
- traceroute —Traceroute
- ttl-exceeded —TTL exceeded
- unreachable —All unreachables
TCP Port Names
When you specify the
protocol argument as
tcp , the
port argument can be a TCP port number, which
is an integer from 0 to 65535. It can also be one of the following keywords:
bgp —Border Gateway Protocol (179)
chargen —Character generator (19)
cmd —Remote commands (rcmd, 514)
daytime —Daytime (13)
discard —Discard (9)
domain —Domain Name Service (53)
drip —Dynamic Routing Information Protocol
(3949)
echo —Echo (7)
exec —Exec (rsh, 512)
finger —Finger (79)
ftp —File Transfer Protocol (21)
ftp-data —FTP data connections (20)
gopher —Gopher (7)
hostname —NIC hostname server (11)
ident —Ident Protocol (113)
irc —Internet Relay Chat (194)
klogin —Kerberos login (543)
kshell —Kerberos shell (544)
login —Login (rlogin, 513)
lpd —Printer service (515)
nntp —Network News Transport Protocol (119)
pim-auto-rp —PIM Auto-RP (496)
pop2 —Post Office Protocol v2 (19)
pop3 —Post Office Protocol v3 (11)
smtp —Simple Mail Transport Protocol (25)
sunrpc —Sun Remote Procedure Call (111)
tacacs —TAC Access Control System (49)
talk —Talk (517)
telnet —Telnet (23)
time —Time (37)
uucp —UNIX-to-UNIX Copy Program (54)
whois —WHOIS/NICNAME (43)
www —World Wide Web (HTTP, 80)
UDP Port Names
When you specify the
protocol argument as
udp , the
port argument can be a UDP port number, which
is an integer from 0 to 65535. It can also be one of the following keywords:
biff —Biff (mail notification, comsat, 512)
bootpc —Bootstrap Protocol (BOOTP) client
(68)
bootps —Bootstrap Protocol (BOOTP) server
(67)
discard —Discard (9)
dnsix —DNSIX security protocol auditing (195)
domain —Domain Name Service (DNS, 53)
echo —Echo (7)
isakmp —Internet Security Association and Key
Management Protocol (5)
mobile-ip —Mobile IP registration (434)
nameserver —IEN116 name service (obsolete,
42)
netbios-dgm —NetBIOS datagram service (138)
netbios-ns —NetBIOS name service (137)
netbios-ss —NetBIOS session service (139)
non500-isakmp —Internet Security Association
and Key Management Protocol (45)
ntp —Network Time Protocol (123)
pim-auto-rp —PIM Auto-RP (496)
rip —Routing Information Protocol (router,
in.routed, 52)
snmp —Simple Network Management Protocol
(161)
snmptrap —SNMP Traps (162)
sunrpc —Sun Remote Procedure Call (111)
syslog —System Logger (514)
tacacs —TAC Access Control System (49)
talk —Talk (517)
tftp —Trivial File Transfer Protocol (69)
time —Time (37)
who —Who service (rwho, 513)
xdmcp —X Display Manager Control Protocol
(177)
Feedback