PurposeCommand or Action
Enters IP ACL configuration mode for the ACL that you
specify by name.
Enter one of the following commands:
Step 2
• ip access-list name
• ipv6 access-list name
Example:
switch(config)# ip access-list acl-01
switch(config-acl)#
Creates a rule in the IP ACL. Using a sequence number
allows you to specify a position for the rule in the ACL.
(Optional) [sequence-number] {permit | deny} protocol
source destination
Step 3
Without a sequence number, the rule is added to the end of
Example:
the rules. The sequence-number argument can be a whole
number between 1 and 4294967295.
switch(config-acl)# 100 permit ip 192.168.2.0/24
any
The permit and deny commands support many ways of
identifying traffic.
Optimizes fragment handling for noninitial fragments. When
a device applies to traffic an ACL that contains the
(Optional) [no] fragments {permit-all | deny-all}
Example:
Step 4
fragments command, the fragments command only
switch(config-acl)# fragments permit-all
matches noninitial fragments that do not match any explicit
permit or deny commands in the ACL.
The no option removes fragment-handling optimization.
Removes the rule that you specified from the IP ACL.
(Optional) no {sequence-number | {permit | deny}
protocol source destination}
Step 5
The permit and deny commands support many ways of
identifying traffic.
Example:
switch(config-acl)# no 80
Specifies that the device maintains global statistics for
packets that match the rules in the ACL.
(Optional) [no] statistics per-entry
Example:
Step 6
The no option stops the device from maintaining global
statistics for the ACL.
switch(config-acl)# statistics per-entry
Displays the IP ACL configuration.(Optional) Enter one of the following commands:
Step 7
• show ip access-lists name
• show ipv6 access-lists name
Example:
switch(config-acl)# show ip access-lists acl-01
Copies the running configuration to the startup
configuration.
(Optional) copy running-config startup-config
Example:
Step 8
switch(config-acl)# copy running-config
startup-config
Related Topics
Changing Sequence Numbers in an IP ACL, on page 238
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
236
Configuring IP ACLs
Changing an IP ACL
To Next Page
Loading...
