access-list command for creating a numbered, extended ACL

Syntax


access-list <100-199> <deny|permit> <ip|ip-protocol|ip-protocol-nbr>
<any|host <SA>|SA/mask-length|SA <mask>>
<any|host <DA>|DA/mask-length|DA <mask>>
[log]

Description

If the ACL does not already exist, this command creates the specified ACL and its first ACE. If the ACL already exists, the new ACE is appended to the .end of the configured list of explicit ACEs. In the default configuration, the ACEs in an ACL will automatically be assigned consecutive sequence numbers in increments of 10 and can be renumbered with resequence see Resequencing the ACEs in an ACL.

NOTE:

To insert a new ACE between two existing ACEs in an extended, numbered ACL:

  1. Use ip access list extended <100-199> to open the ACL as a named ACL.

  2. Enter the desired sequence number along with the ACE statement you want.

For a match to occur, a packet must have the source and destination addressing criteria specified in the ACE, as well as:

  • The protocol-specific criteria configured in the ACE, including any included, optional elements (described later in this section.)

  • Any (optional) precedence and/or ToS settings configured in the ACE.

Parameters


<100-199>

Specifies the ACL ID number. The switch interprets a numeric ACL with a value in this range as an extended ACL. 


<deny|permit>

Specifies whether to deny (drop) or permit (forward) a packet that matches the criteria specified in the ACE, as described below. 


<ip|ip-protocol|ip-protocol-nbr>
Specifies the packet protocol type required for a match. An extended ACL must include one of the following:

  • ip – any IPv4 packet.

  • ip-protocol – any one of the following IPv4 protocol names:

    • ip-in-ip

    • ipv6-in-ip

    • gre

    • esp

    • ah

    • ospf

    • pim

    • vrrp

    • sctp

    • tcp*

    • udp*

    • icmp*

    • igmp*

    * For TCP, UDP, ICMP, and IGMP, additional criteria can be specified, as described later in this section.

  • ip-protocol-nbr – the protocol number of an IPv4 packet type, such as "8" for Exterior Gateway Protocol or 121 for Simple Message Protocol. (For a listing of IPv4 protocol numbers and their corresponding protocol names, see the IANA "Protocol Number Assignment Services" at http://www.iana.com.) (Range: 0-255). 


<any|host <SA>|SA/mask-length|SA <mask>>

In an extended ACL, this parameter defines the source address (SA) that a packet must carry in order to have a match with the ACE.

  • any – Specifies all inbound IPv4 packets.

  • host <SA> – Specifies only inbound IPv4 packets from a single address. Use this option when you want to match only the IPv4 packets from a single source address.

  • SA/mask-length or SA <mask> – Specifies packets received from an SA, where the SA is either a subnet or a group of IPv4 addresses. The mask can be in either dotted-decimal format or CIDR format with the number of significant bits. 


SA mask application

The mask is applied to the SA in the ACL to define which bits in a packet's source SA must exactly match the address configured in the ACL and which bits need not match.

Example:

10.10.10.1/24 and 10.10.10.1 0.0.0.255 both define any IPv4 address in the range of 10.10.10. (1-255).

NOTE:

Specifying a group of contiguous IPv4 addresses may require more than one ACE.

This is the second instance of addressing in an extended ACE. It follows the first (SA) instance, described earlier, and defines the destination address (DA) that a packet must carry in order to have a match with the ACE.

Syntax: 


<any|host <DA>|DA/mask-length>>

The options are the same as shown for <SA>.

  • any – Allows routed IPv4 packets to any DA.

  • host <DA> – Specifies only the packets having DAas the destination address. Use this criterion when you want to match only the IPv4 packets for a single DA.

  • DA/mask-length or DA <mask> – Specifies packets intended for a destination address, where the address is either a subnet or a group of IPv4 addresses. The mask format can be in either dotted-decimal format or CIDR format (number of significant bits). 
    
DA Mask application
    The mask is applied to the DA in the ACL to define which bits in a packet's DA must exactly match the DA configured in the ACL and which bits need not match. See also the above example and note. 

[log]
Optional; generates an Event Log message if:

  • The action is deny. This option is not configurable for Permit.

  • There is a match.

  • ACL logging is enabled on the switch.