CLI Guide

Layer 2 Switching Commands 276
User Guidelines
Access lists use the extended access list format. Multiple permit and deny
clauses and actions may be specified without requiring the access list name to
be entered each time. Permit and deny clauses are entered in order from the
first match clause when in Access List Configuration mode.
ACL names are global. An IPv6 access list cannot have the same name as an
IPv4 access list. Access list names can consist of any printable character
except a question mark. Names can be up to 31 characters in length. ACLs
referenced in a route map may not be edited. Instead, create a new ACL with
the desired changes and refer to the new ACL in the route map.
deny | permit (IP ACL)
Use this command in Ipv4-Access-List Configuration mode to create a new
rule for the current IP access list. Each rule is appended to the list of
configured rules for the list if no sequence number is specified. Use the no
form of the command to delete an existing permit/deny clause.
Syntax
[sequence-number]{deny | permit} {ipv4-protocol | 0-255 | every} {srcip
srcmask | any | host srcip} [{range {portkey | startport} {portkey |
endport}} | {eq | neq | lt | gt} {portkey | 0-65535} ] {dstip dstmask | any |
host dstip} [{range {portkey | startport} {portkey | endport}} | {eq | neq |
lt | gt} {portkey | 0-65535}] [flag [+fin | -fin] [+syn | -syn] [+rst | -rst]
[+psh | -psh] [+ack | -ack] [+urg | -urg] [established]] [icmp-type icmp-
type [icmp-code icmp-code] | icmp-message icmp-message] [igmp-type
igmp-type] [fragments] [precedence precedence | tos tos [tosmask] | dscp
dscp]}} [time-range time-range-name] [log] [assign-queue queue-id]
[{mirror | redirect} interface-id] [rate-limit rate burst-size]
no <sequence-number>
• [sequence-number] —Identifies the order of application of the
permit/deny statement. If no sequence number is assigned, permit/deny
statements are assigned a sequence number beginning at 1000 and
incrementing by 10. Statements are applied in hardware beginning with
the lowest sequence number. Sequence numbers only have applicability
within an access group, i.e. the ordering applies within the access-group
scope. The range for sequence numbers is 1– 2147483647.