Extended ACL Instance
15-7
deny [tcp|udp] [<source-IP/
Mask>|any|host <IP>] {eq
<source-port>|range
<starting-source-port>
<ending-source-port>}
[<dest-IP/Mask|any|host
<IP>]{eq <source-port>}
{range <starting-source-
port> <ending-source-
port>} {log} {rule-
precedence
<1-5000>}
Use with the deny command to reject TCP or UDP packets
• deny – Rejects TCP or UDP packets
• tcp|udp – Specifies TCP or UDP as the protocol
• <source-IP/Mask>|any|host <IP> – The source is the
source IP address of the network or host (in dotted
decimal format). The source-mask is the network mask.
For example, 10.1.1.10/24 indicates the first 24 bits of
the source IP are used for matching
• any – any is an abbreviation for a source IP of 0.0.0.0,
and the source-mask bits are equal to 0
• host – host is an abbreviation for exact source (A.B.C.D)
and the source-mask bits equal to 32
• eq <source-port> – The source port <source-port> to
match. Values in the range 1 to 65535.
• range <starting-source-port> <ending-source-port> –
Specifies the protocol range (starting and ending
protocol numbers)
• <dest-IP/Mask|any|host <IP> – Defines the destination
host IP address or destination network address
• eq <source-port> {range <starting-source-port>
<ending-source-port>|word|bgp|dns|ftp|ftp-
data|gopher|https|ldap|nntp|ntp|pop3|smtp|ssh|telnet|
tftp|www} – Defines a specific destination port
• range <starting-source-port> <ending-source-port>
– Specifies the destination port or range of ports.
Port values are in the range of 1 to 65535.
• <WORD> – Displays any service name
• bgp – port 179
• dns – dns port 53
• ftp –ftp-ctrlport 21
To Next Page
Loading...
Need help?
General
