User's Manual

A CCESS C ONTROL L IST C OMMANDS
4-126
[no] {permit | deny} tcp
{any | source address-bitmask | host source}
{any | destination address-bitmask | host destination}
[precedence precedence] [tos tos] [dscp dscp]
[source-port sport [bitmask]] [destination-port dport [port-bitmask]]
[control-flag control-flags flag-bitmask]
• protocol-number – A specific protocol number. (Range: 0-255)
• source – Source IP address.
• destination – Destination IP address.
• address-bitmask – Decimal number representing the address bits to
match.
• host – Keyword followed by a specific IP address.
• precedence – IP precedence level. (Range: 0-7)
• tos – Type of Service level. (Range: 0-15)
• dscp – DSCP priority level. (Range: 0-63)
• sport – Protocol
25
source port number. (Range: 0-65535)
• dport – Protocol
25
destination port number. (Range: 0-65535)
• port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
• control-flags – Decimal number (representing a bit string) that specifies
flag bits in byte 14 of the TCP header. (Range: 0-63)
• flag-bitmask – Decimal number representing the code bits to match.
Default Setting
None
Command Mode
Extended ACL
Command Usage
• All new rules are appended to the end of the list.
• Address bitmasks are similar to a subnet mask, containing four integers
from 0 to 255, each separated by a period. The binary mask uses 1 bits
to indicate “match” and 0 bits to indicate “ignore.” The bitmask is
bitwise ANDed with the specified source IP address, and then compared
25. Includes TCP, UDP or other protocol types.