Filter
Top Products
Chapter 73: Advanced Access Control Lists (ACLs)
1170
Numbered IPv4 ACL with IP Packets Examples
This is the command format for creating ACLs that filter IP packets based
on source and destination IPv4 addresses:
access-list
id_number action
ip
src_ipaddress
dst_ipaddress
[vlan
vid
]
The ID_NUMBER parameter assigns the ACL a unique ID number in the
range of 3000 to 3699. Within this range, you can number ACLs in any
order.
The ACTION parameter specifies the action that the port performs on
packets matching the filtering criteria of the ACL. Here are the possible
actions:
permit— Forwards all ingress packets that match the ACL. Ports,
by default, accept all ingress packets. Consequently, a permit ACL
is only necessary when you want a port to forward a subset of
packets that are otherwise discarded.
deny— Discards all ingress packets that match the ACL.
copy-to-mirror— Copies all ingress packets that match the ACL to
the destination port of the mirror port. This action must be used
together with the port mirror feature, explained in Chapter 21, “Port
Mirror” on page 379.
The SRC_IPADDRESS and DST_IPADDRESS parameters specify the
source and destination IPv4 addresses. Choose from the following
options:
any— Matches any IP address.
ipaddress/mask— Matches packets that have an IP address of a
subnet or an end node. The mask is a decimal number that
represents the number of bits in the address, from left to right, that
constitute the network portion of the address. For example, the
subnet address 149.11.11.0/24 has a mask of “24” for the first
twenty-four bits of the network portion of the address. The IP
address and the mask are separated by a slash (/); for example,
“149.11.11.0/24.”