Users Guide

Access Control Lists 725
console(config-if-gi1/0/2)#exit
Consider the following inbound rules that allow Telnet connections and UDP
traffic from the 192.168.0.x network to host 10.1.1.23:
ip access-list Host10-1-1-23
! Permit Telnet traffic from 192.168.0.X network to host 10.1.1.23:
permit tcp 192.168.0.0 0.0.0.255 host 10.1.1.23 eq telnet
! Permit TCP traffic from 192.168.0.X network to host 10.1.1.23:
permit tcp 192.168.0.0 0.0.0.255 host 10.1.1.23
! Permit UDP traffic from 192.168.0.X network to host 10.1.1.23
permit udp 192.168.0.0 0.0.0.255 host 10.1.1.23
! Permit IP traffic from 192.168.0.X network to 10.1.1.x network
permit ip 192.168.0.0 0.0.0.255 10.1.1.23 0.0.0.255
In the above list, the fourth rule allows all IP packets between the network
and host. The narrower scope of the first three rules is redundant, as all IP
traffic, including TCP and UDP, is permitted by the fourth rule.
The following list has corrected rules that allow Telnet and UDP packets only
and rely on the implicit “deny all” after the end of the last access group to
deny other traffic.
ip access-list Host10-1-1-23
! Permit Telnet traffic from 192.168.0.X network to host 10.1.1.23
permit tcp 192.168.0.0 0.0.0.255 host 10.1.1.23 eq telnet
! Permit UDP traffic from 192.168.0.X network to host 10.1.1.23
permit udp 192.168.0.0 0.0.0.255 host 10.1.1.23
The ACL feature supports TCP and UDP port matching using operators:
console(config-ip-acl)#permit tcp 10.1.1.0 0.0.0.255 ?
<dstip> Enter a Destination IP Address.
any Match any Destination IP Address.
eq Matches only if port number is equal.
gt Matches only if port number is greater.
host Enter a destination host.
lt Matches only if port number is less.
neq Matches only if port number is not equal.
range Specify the range of ports.
The range operator is inclusive of the specified port parameters.
ACLs support TCP flags. If multiple flags are set (+flag) in a single rule, only
packets with the all the same flags asserted are matched (logical AND).
Likewise, if multiple flags are cleared (–flag) in a single rule, only packets with
the same flags cleared are matched. The established keyword matches TCP