To Next Page

To Previous Page

10-67

IPv4 Access Control Lists (ACLs)

Configuring Extended ACLs

Options for TCP and UDP Traffic in Extended ACLs. An ACE designed

to permit or deny TCP or UDP traffic can optionally include port number

criteria for either the source or destination, or both. Use of TCP criteria also

allows the established option for controlling TCP connection traffic. (For a

summary of the extended ACL syntax options, refer to table on page 10-59.)

Syntax: < deny | permit > tcp

< SA > [comparison-operator < tcp-src-port >]

< DA > [comparison-operator < tcp-dest-port >]

[established]

[ ack ] [ fin ]

[ rst ] [ syn ]

Syntax: < deny | permit > udp

< SA > [comparison-operator < udp-src-port >]

< DA > [comparison-operator < udp-dest-port >]

In an extended ACL using either tcp or udp as the packet protocol

type, you can optionally use TCP or UDP source and/or desti-

nation port numbers or ranges of numbers to further define the

criteria for a match. For example:

deny tcp host 10.20.10.17 eq 23 host 10.20.10.155

established

#permit tcp host 10.10.10.100 host 10.20.10.17

eq telnet

#deny udp 10.30.10.1/24 host 10.20.10.17 range

161 162

[comparison-operator < tcp/udp-src-port >]

To specify a TCP or UDP source

port number in an ACE, (1)

select a comparison operator from the following list and (2)

enter the port number or a well-known port name.

Other manuals for HP 3500yl Series

Questions and Answers:

Need help?

Do you have a question about the HP 3500yl Series and is the answer not in the manual?

General