10-67
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Options for TCP and UDP Traffic in Extended ACLs. An ACE designed
to permit or deny TCP or UDP traffic can optionally include port number
criteria for either the source or destination, or both. Use of TCP criteria also
allows the established option for controlling TCP connection traffic. (For a
summary of the extended ACL syntax options, refer to table on page 10-59.)
Syntax: < deny | permit > tcp
< SA > [comparison-operator < tcp-src-port >]
< DA > [comparison-operator < tcp-dest-port >]
[established]
[ ack ] [ fin ]
[ rst ] [ syn ]
Syntax: < deny | permit > udp
< SA > [comparison-operator < udp-src-port >]
< DA > [comparison-operator < udp-dest-port >]
In an extended ACL using either tcp or udp as the packet protocol
type, you can optionally use TCP or UDP source and/or desti-
nation port numbers or ranges of numbers to further define the
criteria for a match. For example:
#
deny tcp host 10.20.10.17 eq 23 host 10.20.10.155
established
#permit tcp host 10.10.10.100 host 10.20.10.17
eq telnet
#deny udp 10.30.10.1/24 host 10.20.10.17 range
161 162
[comparison-operator < tcp/udp-src-port >]
To specify a TCP or UDP source
port number in an ACE, (1)
select a comparison operator from the following list and (2)
enter the port number or a well-known port name.
To Next Page
Loading...
Need help?
General