Connectivity Guide

Assign sequence number to lter
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# seq 5 deny tcp any any capture session 1 count
View ACLs and packets processed through ACL
OS10# show ip access-lists in
Ingress IP access-list acl1
Active on interfaces :
ethernet1/1/5
seq 5 permit ip any any count (10000 packets)
Delete ACL rule
Before release 10.4.2, deleting ACL rules required a sequence number.
After release 10.4.2 or later, you can also delete ACL rules using the no form of the CLI command without using a sequence number.
While deleting ACL rules, the following conditions apply:
• Enter the exact no form of the CLI command. Each ACL rule is an independent entity. For example, the rule, deny ip any any is
dierent from deny ip any any count.
For example, if you congured the following rules:
deny ip 1.1.1.1/24 2.2.2.2/24
deny ip any any
Using the no deny ip any any command deletes only the deny ip any any rule.
To delete the deny ip 1.1.1.1/24 2.2.2.2/24 rule, you must explicitly use the no deny ip 1.1.1.1/24 2.2.2.2/24
command.
NOTE
: Wildcard option is not supported.
• You can no longer congure the same ACL rule multiple times using dierent sequence numbers. This option prevents duplicate rules
from being entered in the system and taking up memory space.
• When you upgrade from a previous release to release 10.4.2 or later, the upgrade procedure removes all duplicate ACL rules and only
one instance of an ACL rule remains in the system.
L2 and L3 ACLs
Congure both L2 and L3 ACLs on an interface in L2 mode. Rules apply if you use both L2 and L3 ACLs on an interface.
• L3 ACL lters packets and then the L2 ACL lters packets
• Egress L3 ACL lters packets
Rules apply in order:
• Ingress L3 ACL
• Ingress L2 ACL
• Egress L3 ACL
• Egress L2 ACL
NOTE
: In ingress ACLs, L2 has a higher priority than L3 and in egress ACLs, L3 has a higher priority than L2.
Access Control Lists 697