IPv4-Based ACE

ACL Name

Displays the name of the ACL to which an ACE is being added.

Priority

Enter the priority. ACEs with higher priority are processed first.

Action

Select the action assigned to the packet matching the ACE from the following options:

• Permit—Forward packets that meet the ACE criteria.

• Deny—Drop packets that meet the ACE criteria.

• Shutdown—Drop packets that meet the ACE criteria, and disable the port to which the packets addressed.

Protocol

Select to create an ACE based on a specific protocol or protocol ID. Select Any (IPv4) to accept all IP protocols. Otherwise select one of the following protocols:

• ICMP—Internet Control Message Protocol

• IP in IP—IP in IP encapsulation

• TCP—Transmission Control Protocol

• EGP—Exterior Gateway Protocol

• IGP—Interior Gateway Protocol

• UDP—User Datagram Protocol

• HMP—Host-Mapping Protocol

• RDP—Reliable Datagram Protocol.

• IPV6—IPv6 over IPv4 tunneling

• IPV6:ROUT—Matches packets belonging to the IPv6 over IPv4 route through a gateway

• IPV6:FRAG—Matches packets belonging to the IPv6 over IPv4 Fragment Header

• RSVP—ReSerVation Protocol

• IPV6:ICMP—Internet Control Message Protocol

• OSPF—Open Shortest Path First

• PIM—Protocol Independent Multicast

• L2TP—Layer 2 Tunneling Protocol

• Protocol ID to Match—Instead of selecting the name, enter the protocol ID.

Source IP Address

Select Any if all source addresses are acceptable or User defined to enter a source address or range of source addresses.

Source IP Address Value

Enter the IP address to which the source IP address is to be matched and its mask (if relevant).

Source IP Wildcard Mask

Enter the mask to define a range of IP addresses. This mask is different than in other uses, such as subnet mask. Here, setting a bit as 1 indicates don't care and 0 indicates to mask that value.

Destination IP Address

Select Any if all destination addresses are acceptable or User defined to enter a destination address or a range of destination addresses.

Destination IP Address Value

Enter the IP address to which the destination MAC address is matched and its mask (if relevant).

Destination IP Wildcard Mask

Enter the destination IP wildcard mask.

Source Port

Select one of the following

• Any—Match to all source ports.

• Single from list—Select a single TCP/UDP source port to which packets are matched. This field is active only if 800/6-TCP or 800/17-UDP is selected in the IP Protocol drop-down menu.

• Single by number—Enter a single TCP/UDP source port to which packets are matched. This field is active only if 800/6-TCP or 800/17-UDP is selected in the IP Protocol drop-down menu.

• Range—Enter a range from 0 - 65535.

Destination Port

Select one of the available values. They are the same as for the Source Port field described above.

TCP Flags

Select one or more TCP flags with which to filter packets. Filtered packets are either forwarded or dropped. Filtering packets by TCP flags increases packet control, which increases network security. For each type of flag, select one of the following options:

• Set—Match if the flag is SET.

• Unset—Match if the flag is Not SET.

• Don’t care—Ignore the TCP flag.

Type of Service

The service type of the IP packet.

• Any—Any service type

• DSCP to match—Differentiated Serves Code Point (DSCP) to match.

• IP Precedence to match—IP precedence is a model of TOS (type of service) that the network uses to help provide the appropriate QoS commitments. This model uses the 3 most significant bits of the service type byte in the IP header, as described in RFC 791 and RFC 1349.

ICMP

If the ACL is based on ICMP, select the ICMP message type that is used for filtering purposes. Either select the message type by name or enter the message type number. If all message types are accepted, select Any.

• Any—All message types are accepted.

• Select from list—Select message type by name from the drop-down list.

• ICMP Type to Match—Number of message types that is to be used for filtering purposes.

ICMP Code

The ICMP messages may have a code field that indicates how to handle the message. Select one of the following options, to configure whether to filter on this code:

• Any—Accept all codes.

• User Defined—Enter an ICMP code for filtering purposes.