Administrator Guide
Layer 2 Switching Commands 266
ACL names are global. An IPv6 access list cannot have the same name as an
IPv4 access list. Access list names can consist of any printable character
except a question mark.. Names can be up to 31 characters in length. ACLs
referenced in a route map may not be edited. Instead, create a new ACL with
the desired changes and refer to the new ACL in the route map.
deny | permit (IP ACL)
Use this command in Ipv4-Access-List Configuration mode to create a new
rule for the current IP access list. Each rule is appended to the list of
configured rules for the list if no sequence number is specified. Use the no
form of the command to delete an existing permit/deny clause.
Syntax
[
sequence-number
]deny | permit (IP ACL)
[
sequence-number
]{deny | permit} {every | {{
ipv4-protocol
|
0-255
|
every
} {
srcip srcmask
| any | host
srcip
} [{range {
portkey
|
startport
}
{
portkey
|
endport
} | {eq | neq | lt | gt} {
portkey
|
0-65535
} ] {
dstip
dstmask
| any | host
dstip
} [{range {
portkey
|
startport
} {
portkey
|
endport
} | {eq | neq | lt | gt} {
portkey
|
0-65535
}] [flag [+fin | -fin]
[+syn | -syn] [+rst | -rst] [+psh | -psh] [+ack | -ack] [+urg | -urg]
[established]] [icmp-type
icmp-type
[icmp-code
icmp-code
] | icmp-message
icmp-message
] [igmp-type
igmp-type
] [fragments] [precedence
precedence
| tos
tos
[
tosmask
] | dscp
dscp
]}} [time-range
time-range-name
] [log]
[assign-queue
queue-id
] [{mirror | redirect}
interface-id
] [rate-limit
rate
burst-size
]
no [
sequence-number
]
•
sequence-number
—Identifies the order of application of the permit/deny
statement. If no sequence number is assigned, permit/deny statements are
assigned a sequence number beginning at 1000 and incrementing by 10.
Statements are applied in hardware beginning with the lowest sequence
number. Sequence numbers only have applicability within an access group,
i.e. the ordering applies within the access-group scope. The range for
sequence numbers is 1– 2147483647.
•{
deny | permit
}–Specifies whether the IP ACL rule permits or denies the
matching traffic.
2CSNXXX_SWUM204.book Page 266 Monday, January 25, 2016 1:25 PM