Reference Guide

Access Control Lists (ACL) | 203
When you use the log option, CP processor logs details about the packets that match.
Depending on how many packets match the
log entry and at what rate, the CP may
become busy as it has to log these packets’ details.
Related
Commands
Extended IP ACL Commands
When an ACL is created without any rule and then applied to an interface, ACL
behavior reflects an implicit permit.
The following commands configure extended IP ACLs, which in addition to the IP
address also examine the packet’s protocol type.
c platforms support Ingress IP ACLs only.
e and s platforms support Ingress and Egress IP ACLs.
• deny
• deny arp
• deny ether-type
• deny icmp
• deny tcp
• deny udp
• ip access-list extended
• permit
• permit arp
• permit ether-type
• permit icmp
• permit tcp
• permit udp
• resequence access-list
• resequence prefix-list ipv4
• seq arp
• seq ether-type
Note: When ACL logging and byte counters are configured simultaneously, byte
counters may display an incorrect value. Configure packet counters with logging
instead.
deny Configure a filter to drop packets.
permit Configure a filter to forward packets.
seq Assign a sequence number to a deny or permit filter in an IP access list while
creating the filter.