Reference Guide

Table 14: ACL Command Parameters (continued)
Parameter Description
flag [+fin | -fin] [+syn | -syn] [+rst | -rst]
[+psh | -psh] [+ack | -ack] [+urg | -urg]
[established]
This option is available only if the protocol is tcp.
Specifies that the IP ACL rule matches on the TCP flags.
When +tcpflagname is specified, a match occurs if the specified
tcpflagname flag is set in the TCP header.
When -tcpflagname is specified, a match occurs if the specified
tcpflagname flag is not set in the TCP header.
When established is specified, a match occurs if the specified RST or
ACK bits are set in the TCP header. Two rules are installed in the
hardware when the established option is specified.
[icmp-type icmp-type [icmp-code
icmp-code] | icmp-message icmp-
message]
This option is available only if the protocol is icmp.
Specifies a match condition for ICMP (Internet Control Message
Protocol) packets.
When icmp-type is specified, the IP ACL rule matches on the
specified ICMP message type, a number from 0 to 255.
When icmp-code is specified, the IP ACL rule matches on the
specified ICMP message code, a number from 0 to 255.
Specifying icmp-message implies that both icmp-type and icmp-
code are specified. The following icmp-messages are supported: echo,
echo-reply, host-redirect, mobile-redirect, net-
redirect, net-unreachable, redirect, packet-too-big,
port-unreachable, source-quench, router-solicitation,
router-advertisement, time-exceeded, ttl-exceeded and
unreachable.
igmp-type igmp-type This option is available only if the protocol is igmp.
When igmp-type is specified, the IP ACL rule matches on the specified
IGMP (Internet Group Management Protocol) message type, a number
from 0 to 255.
fragments Specifies that the IP ACL rule matches on fragmented IP packets.
[log]
Specifies that this rule is to be logged.
[time-range time-range-name] Allows imposing time limitation on the ACL rule as defined by the
parameter time-range-name. If a time range with the specified name
does not exist and the ACL containing this ACL rule is applied to an
interface or bound to a VLAN, then the ACL rule is applied immediately.
If a time range with specified name exists and the ACL containing this
ACL rule is applied to an interface or bound to a VLAN, the ACL rule is
applied when the time-range with specified name becomes active. The
ACL rule is removed when the time-range with specified name becomes
inactive. For information about configuring time ranges, see Time Range
Commands for Time-Based ACLs on page 653.
[assign-queue queue-id] Specifies the assign-queue, which is the queue identifier to which
packets matching this rule are assigned.
[rate-limit rate burst-size] Specifies the allowed rate of trac as per the configured rate in kbps,
and burst-size in kbytes.
no access-list
This command deletes an IP ACL that is identified by the parameter accesslistnumber from the system.
The range for accesslistnumber 1-99 for standard access lists and 100-199 for extended access lists.
Quality of Service Commands
ExtremeSwitching 200 Series: Command Reference Guide for version 01 .02.04.0007 630