access-list ip

Syntax

access-list ip <ACL-NAME>

    [<SEQUENCE-NUMBER>]
    {permit|deny}
    {any|ah|gre|esp|icmp|igmp|ospf|pim|<IP-PROTOCOL-NUM>}
    {any|<SRC-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}
    {any|<DST-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}
    [dscp {AF11|AF12|AF13|AF21|AF22|AF23|AF31|AF32|AF33|AF41|AF42|AF43|
          CS0|CS1|CS2|CS3|CS4|CS5|CS6|CS7|EF|<DSCP-VALUE>}][ecn <ECN-VALUE>] 
    [ip-precedence <IP-PRECEDENCE-VALUE>] [tos <TOS-VALUE>]
    [fragment] [vlan <VLAN-ID>] [ttl <TTL-VALUE>] [count] [log]

    [<SEQUENCE-NUMBER>]
    {permit|deny}
    {sctp|tcp|udp}
    {any|<SRC-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}
    [{eq|gt|lt} <PORT>|range <MIN-PORT> <MAX-PORT>]
    {any|<DST-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}
    [{eq|gt|lt} <PORT>|range <MIN-PORT> <MAX-PORT>]
    [urg] [ack] [psh] [rst] [syn] [fin] [established]
    [dscp {AF11|AF12|AF13|AF21|AF22|AF23|AF31|AF32|AF33|AF41|AF42|AF43|
          CS0|CS1|CS2|CS3|CS4|CS5|CS6|CS7|EF|<DSCP-VALUE>}] [ecn <ECN-VALUE>] 
    [ip-precedence <IP-PRECEDENCE-VALUE>] [tos <TOS-VALUE>]
    [fragment] [vlan <VLAN-ID>] [ttl <TTL-VALUE>] [count] [log]

    [<SEQUENCE-NUMBER>] comment <TEXT-STRING>

Description

Creates an IPv4 access control list (ACL) comprised of one or more access control entries (ACEs) ordered and prioritized by sequence numbers. The lowest sequence number is the highest prioritized ACE.

The no form of this command can be used to delete an ACL (use no with the access list command). And you can delete an individual ACE (use no with the sequence number command).

Command context

config

The access-list ip <ACL-NAME> command takes you into the named ACL context where you enter the access control entries.

Parameters

<ACL-NAME>

Specifies the name of this ACL.

<SEQUENCE-NUMBER>

Specifies a sequence number for the ACE. Optional, in the range of 1- 4294967295.

{permit|deny}

Specifies whether to permit or deny traffic matching this ACE.

comment

Specifies storing the remaining entered text as an ACE comment.

protocol

Select a protocol from the following (enter one only):

  • any - Any IP protocol

  • <IP-PROTOCOL-NUM> - Enter an IP protocol number. Range: 1-255.

  • Enter an IP protocol name from the following list:

    • ah

    • gre

    • esp

    • icmp

    • igmp

    • ospf (version 2)

    • pim

    • sctp

    • tcp

    • udp

{any|<SRC-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}

Specifies the source IP host, network address, or the keyword any. You can optionally include the following:

  • <PREFIX-LENGTH> - The address bits to mask (CIDR subnet mask notation), range 1-32.

  • <SUBNET-MASK> - The address bits to mask (dotted decimal notation). Optional

{any|<DST-IP-ADDRESS>[/{<PREFIX-LENGTH>|<SUBNET-MASK>}]}

Specifies the destination IP host network address, or the keyword any. You can optionally include the following:

  • <PREFIX-LENGTH> - The address bits to mask (CIDR subnet mask notation), range 1-32.

  • <SUBNET-MASK> - The address bits to mask (dotted decimal notation).

[{eq|gt|lt} <PORT>|range <MIN-PORT> <MAX-PORT>]

Each port to be matched requires a separate hardware entry. The system can run out of hardware resources before the ACE limit is reached when many Layer 4 ports are to be matched.

For example, the 8400 switch supports a maximum of 24,000 ACEs per egress ACL. One ACE containing a source or destination Layer 4 port range of gt 10 results in 4,293,525,625 (65535-10)*(65535-10) hardware entries. This ACE exceeds the hardware capacity of the 8400 switch and cannot be applied.

Specifies matching using one of the following keywords:

  • eq - Layer 4 port is equal to the specified port.

  • gt - Layer 4 port is greater than the specified port.

  • lt - Layer 4 port is less than the specified port.

Relative to either:

  • <PORT> - A single Layer 4 port (range 0-65535).

  • range <MIN-PORT> <MAX-PORT> - A layer 4 port from the minimum to the maximum port inclusive.

urg

Specifies matching on the TCP Flag: Urgent. (Applies only to the "in" (ingress) direction.)

ack

Specifies matching on the TCP Flag: Acknowledgment. (Applies only to the "in" (ingress) direction.)

psh

Specifies matching on the TCP Flag: Push buffered data to receiving application. (Applies only to the "in" (ingress) direction.)

rst

Specifies matching on the TCP Flag: Reset the connection. (Applies only to the "in" (ingress) direction.)

syn

Specifies matching on the TCP Flag: Synchronize sequence numbers. (Applies only to the "in" (ingress) direction.)

fin

Specifies matching on the TCP Flag: Finish connection. (Applies only to the "in" (ingress) direction.)

established

Specifies matching on the TCP Flag: Established connection. (Applies only to the "in" (ingress) direction.)

dscp

Specifies a Differentiated Services Code Point (DSCP) value. Enter either a numeric <DSCP-VALUE> (0-63) or a keyword as follows:

  • AF11 - DSCP 10 (Assured Forwarding Class 1, low drop probability)

  • AF12 - DSCP 12 (Assured Forwarding Class 1, medium drop probability)

  • AF13 - DSCP 14 (Assured Forwarding Class 1, high drop probability)

  • AF21 - DSCP 18 (Assured Forwarding Class 2, low drop probability)

  • AF22 - DSCP 20 (Assured Forwarding Class 2, medium drop probability)

  • AF23 - DSCP 22 (Assured Forwarding Class 2, high drop probability)

  • AF31 - DSCP 26 (Assured Forwarding Class 3, low drop probability)

  • AF32 - DSCP 28 (Assured Forwarding Class 3, medium drop probability)

  • AF33 - DSCP 30 (Assured Forwarding Class 3, high drop probability)

  • AF41 - DSCP 34 (Assured Forwarding Class 4, low drop probability)

  • AF42 - DSCP 36 (Assured Forwarding Class 4, medium drop probability)

  • AF43 - DSCP 38 (Assured Forwarding Class 4, high drop probability)

  • CS0 - DSCP 0 (Class Selector 0: Default)

  • CS1 - DSCP 8 (Class Selector 1: Scavenger)

  • CS2 - DSCP 16 (Class Selector 2: OAM)

  • CS3 - DSCP 24 (Class Selector 3: Signaling)

  • CS4 - DSCP 32 (Class Selector 4: Realtime)

  • CS5 - DSCP 40 (Class Selector 5: Broadcast video)

  • CS6 - DSCP 48 (Class Selector 6: Network control)

  • CS7 - DSCP 56 (Class Selector 7)

  • EF - DSCP 46 (Expedited Forwarding)

ecn <ECN-VALUE>

Specifies an Explicit Congestion Notification value. Range: 0- 3.

fragment

Specifies a fragment packet.

ip-precedence <IP-PRECEDENCE-VALUE>

Specifies an IP precedence value. Range: 0-7.

tos <TOS-VALUE>

Specifies a Type of Service value. Range: 0-31.

ttl <TTL-VALUE>

Specifies a time-to-live value.

vlan <VLAN-ID>

Specifies VLAN tag to match on. 802.1Q VLAN ID.

count

Keeps the hit counts of the number of packets matching this ACE.

log

Keeps a log of the number of packets matching this ACE. The action log can only be combined with deny, not permit.

Authority

Administrators

Usage

When using multiple ACL types (IPv4, IPv6, or MAC) with logging on the same interface, the first packet that matches an ACE with log option is logged. Until the log-timer wait-period is over, any packets matching other ACL types do not create a log. At the end of the wait-period, the switch creates a summary log all the ACLs that were matched, regardless of type.

Examples

Creating an IPv4 ACL with four entries: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# 10 permit udp any 172.16.1.0/24
switch(config-acl-ip)# 20 permit tcp 172.16.2.0/16 gt 1023 any
switch(config-acl-ip)# 30 permit tcp 172.26.1.0/24 any syn ack dscp 10
switch(config-acl-ip)# 40 deny any any any count
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Adding a comment to an existing IPv4 ACE: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# 20 comment Permit all TCP ephemeral ports  
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 Permit all TCP ephemeral ports
           permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Removing a comment from an existing IPv4 ACE: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# no 20 comment
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Adding an ACE (insert line 25) to an existing IPv4 ACL: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# 25 permit icmp 172.16.2.0/16 any
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        25 permit                          icmp
           172.16.2.0/255.255.0.0
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Replacing an ACE in an existing IPv4 ACL: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# 25 permit icmp 172.17.1.0/16 any
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        25 permit                          icmp
           172.17.1.0/255.255.0.0
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Removing an ACE from an IPv4 ACL: 

switch(config)# access-list ip MY_IP_ACL
switch(config-acl-ip)# no 25
switch(config-acl-ip)# exit

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL
        10 permit                          udp
           any
           172.16.1.0/255.255.255.0
        20 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
        30 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
        40 deny                            any
           any
           any
           Hit-counts: enabled

Removing an IPv4 ACL: 

switch(config)# no access-list ip MY_IP_ACL

switch(config)# do show access-list
Type       Name
  Sequence Comment
           Action                          L3 Protocol
           Source IP Address               Source L4 Port(s)
           Destination IP Address          Destination L4 Port(s)
           Additional Parameters
-------------------------------------------------------------------------------
IPv4       MY_IP_ACL2
         1 permit                          udp
           any
           172.16.1.0/255.255.255.0
         2 permit                          tcp
           172.16.2.0/255.255.0.0           >  1023
           any
         3 permit                          tcp
           172.26.1.0/255.255.255.0
           any
           dscp: AF11
           ack
           syn
         4 deny                            any
           any
           any
           Hit-counts: enabled