Users Guide

760 Access Control Lists
[ sequence-number ]
{deny | permit} {ipv6-
protocol | number |
every} {
source-ipv6-
prefix/prefix-length
| any
|
host source-ipv6-
address
} [{range
{
portkey | startport }
{
portkey | endport } |
{eq | neq | lt | gt}
{
portkey | 0-65535 }]
{
destination-ipv6-
prefix/prefix-length
| any
|
host destination-ipv6-
address
} [{range
{
portkey | startport }
{
portkey | endport } |
{eq | neq | lt | gt}
{
portkey | 0-65535 }]
[flag [+fin | -fin] [+syn
| -syn] [+rst | -rst]
[+psh | -psh] [+ack | -
ack] [+urg | -urg]
[established]] [flow-
label
value ] [icmp-type
icmp-type [icmp-code
icmp-code ] | icmp-
message
icmp-message ]
[routing] [fragments]
[dscp
dscp ]}} [log]
[assign-queue
queue-id ]
[{mirror | redirect}
interface ] [rate-limit
rate burst-size ]
• sequence-number — Identifies the order of application
of the permit/deny statement. If no sequence number is
assigned, permit/deny statements are assigned a sequence
number beginning at 1000 and incrementing by 10.
Statements are applied in hardware beginning with the
lowest sequence number. Sequence numbers are
applicable only within an access group; i.e., the ordering
applies within the access-group scope. The range for
sequence numbers is 1–2147483647.
• {deny | permit} — Specifies whether the IP ACL rule
permits or denies the matching traffic.
• {
ipv6-protocol | number | every} — Specifies the
protocol to match for the IP ACL rule.
– IPv4 protocols: icmpv6, ipv6, tcp and udp
– every: Match any protocol (don’t care)
•
source-ipv6-prefix / prefixlength | any | host src-ipv6-
address
— Specifies a source IP address and netmask to
match for the IP ACL rule.
– For IPv6 ACLs, any implies a 0::/128 prefix and a mask
of all ones.
– Specifying “host X::X” implies a prefix length as “/128”
and a mask of 0::/128.
• [{range {
portkey | startport } { portkey | endport } | {eq |
neq | lt | gt} {
portkey | 0-65535 }] — Specifies the
Layer-4 source or destination port match condition for
the IP/TCP/UDP ACL rule. A port number, which ranges
from 0-65535, can be entered, or a
portkey , which can be
one of the following keywords: bgp, domain, echo, ftp,
ftp-data, http, ntp, pop2, pop3, rip, smtp, snmp, telnet,
tftp, telnet, time, who, and www. Each of these keywords
translates into its equivalent destination port number.
– When range is specified, IPv6 ACL rule matches only if
the Layer-4 port number falls within the specified port
range. The
startport and endport parameters identify
the first and last ports that are part of the port range.
They have values from 0 to 65535. The ending port
must have a value equal or greater than the starting
port. The starting port, ending port, and all ports in
between will be part of the Layer-4 port range.
Command Purpose