785
Configuring IPv6 ACLs
Configuring IPv6 ACLs
(Optional) port-number– Value of 0 to 65535 or TCP
or UDP port name. Use TCP port names only when
filtering TCP. Use UDP port names only when filtering
UDP.
(Optional) dscp value–Match a differentiated services
code point value against the traffic class value in the
Traffic Class field of each IPv6 packet header. The
acceptable range is from 0 to 63.
(Optional) fragments–Check noninitial fragments.
Keyword is only visible when the protocol is ipv6.
(Optional, router ACLs only) log–Send a logging
message to the console about the packet that
matches the entry. Enter log-input to include the
input interface in the log entry.
(Optional) routing–Specify routing of IPv6 packets.
(Optional) sequence value–Specify the sequence
number for the access list statement. Value range is
from 1 to 4294967295.
(Optional) time-range name–Specify the time range
that applies to the deny or permit statement.
Step
3b
{deny | permit} tcp
{source-ipv6-prefix/prefix-length | any |
host source-ipv6-address} [operator
[port-number]] {destination-ipv6-
prefix/prefix-length | any | host
destination-ipv6-address} [operator
[port-number]] [ack] [dscp
value]
[established] [fin] [log] [log-input] [neq
{port | protocol}] [psh] [range {port |
protocol}] [rst] [routing] [sequence
value] [syn] [time-range name] [urg]
(Optional) Define a TCP access list and the access
conditions.
Enter tcp for Transmission Control Protocol. The
parameters are the same as those described in Step 3a,
with these additional optional parameters:
ack—Acknowledgment bit set.
established—An established connection. A match
occurs if the TCP datagram has the ACK or RST bits
set.
fin—Finished bit set; no more data from sender.
neq {port | protocol}—Match only packets that are not
on a given port number.
psh—Push function bit set.
range {port | protocol}—Match only packets in the port
number range.
rst—Reset bit set.
syn—Synchronize bit set.
urg—Urgent pointer bit set.
Command Purpose
To Next Page
Loading...
Need help?
General
