Reference Guide

● Configure a drop or forward filter in IPV4-ACL mode.
seq sequence-number {deny | permit | remark} {ip-protocol-number | icmp | ip |
protocol | tcp | udp} {source prefix | source mask | any | host} {destination mask
| any | host ip-address} [count [byte]] [fragments]
Auto-generated sequence number
If you are creating an ACL with only one or two filters, you can let the system assign a sequence number based on the order in
which you configure the filters. The system assigns sequence numbers to filters using multiples of ten values.
● Configure a deny or permit filter to examine IP packets in IPV4-ACL mode.
{deny | permit} {source mask | any | host ip-address} [count [byte]] [fragments]
● Configure a deny or permit filter to examine TCP packets in IPV4-ACL mode.
{deny | permit} tcp {source mask] | any | host ip-address}} [count [byte]] [fragments]
● Configure a deny or permit filter to examine UDP packets in IPV4-ACL mode.
{deny | permit} udp {source mask | any | host ip-address}} [count [byte]] [fragments]
Assign sequence number to filter
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# seq 5 deny tcp any any capture session 1 count
View ACLs and packets processed through ACL
OS10# show ip access-lists in
Ingress IP access-list acl1
Active on interfaces :
ethernet1/1/5
seq 5 permit ip any any count (10000 packets)
L2 and L3 ACLs
Configure both L2 and L3 ACLs on an interface in L2 mode. Rules apply if you use both L2 and L3 ACLs on an interface.
● L3 ACL filters packets and then the L2 ACL filters packets
● Egress L3 ACL filters packets
Rules apply in order:
● Ingress L3 ACL
● Ingress L2 ACL
● Egress L3 ACL
● Egress L2 ACL
NOTE: In ingress ACLs, L2 has higher priority than L3 and in egress ACLs, L3 has higher priority than L2.
Table 33. L2 and L3 targeted traffic
L2 ACL / L3 ACL Targeted traffic
Deny / Deny L3 ACL denies
Deny / Permit L3 ACL permits
Permit / Deny L3 ACL denies
Permit / Permit L3 ACL permits
566 Access Control Lists