Administrator Guide

seq 5 permit 10.1.0.0/16 seq 10 deny tcp any any eq 111

Dell(config-std-nacl)#

To view all congured IP ACLs, use the show ip accounting access-list command in EXEC Privilege mode.

Dell#show ip accounting access example interface gig 4/12

Extended IP access list example

seq 15 deny udp any any eq 111

seq 20 deny udp any any eq 2049

seq 25 deny udp any any eq 31337

seq 30 deny tcp any any range 12345 12346

seq 35 permit udp host 10.21.126.225 10.4.5.0 /28

seq 40 permit udp host 10.21.126.226 10.4.5.0 /28

seq 45 permit udp 10.8.0.0 /16 10.50.188.118 /31 range 1812 1813

seq 50 permit tcp 10.8.0.0 /16 10.50.188.118 /31 eq 49

seq 55 permit udp 10.15.1.0 /24 10.50.188.118 /31 range 1812 1813

To delete a lter, enter the show config command in IP ACCESS LIST mode and locate the sequence number of the lter you

want to delete. Then use the

no seq sequence-number command in IP ACCESS LIST mode.

Congure an Extended IP ACL

Extended IP ACLs lter on source and destination IP addresses, IP host addresses, TCP addresses, TCP host addresses, UDP

addresses, and UDP host addresses.

Because trac passes through the lter in the order of the lter’s sequence, you can congure the extended IP ACL by rst entering

IP ACCESS LIST mode and then assigning a sequence number to the lter.

Conguring Filters with a Sequence Number

To congure lters with a sequence number, use the following commands.

1. Enter IP ACCESS LIST mode by creating an extended IP ACL.

CONFIGURATION mode

ip access-list extended access-list-name

2. Congure a drop or forward lter.

CONFIG-EXT-NACL mode

seq sequence-number {deny | permit} {ip-protocol-number | icmp | ip | tcp | udp} {source

mask | any | host ip-address} {destination mask | any | host ip-address} [operator port

[port]] [count [byte]] [order] [fragments]

When you create the lters with a specic sequence number, you can create the lters in any order and the lters are placed in the

correct order.

NOTE: When assigning sequence numbers to lters, you might need to insert a new lter. To prevent reconguring

multiple lters, assign sequence numbers in multiples of ve or another number.

The following examples shows how the seq command orders the lters according to the sequence number assigned. In the

example, lter 15 was congured before lter 5, but the show config command displays the lters in the correct order.

Dell(conf-ext-nacl)#seq 15 deny ip host 112.45.0.0 any

Dell(conf-ext-nacl)#seq 5 permit tcp 12.1.3.45 255.255.0.0 any

Dell(conf-ext-nacl)#show config

ip access-list extended dilling

seq 5 permit tcp 12.1.0.0 255.255.0.0 any

seq 15 deny ip host 112.45.0.0 any

Dell(conf-ext-nacl)#

Access Control Lists (ACLs)