Filter
Top Products
Installation and Getting Started Guide
209.157.22.26 0.0.0.255, then save the changes to the startup-config file, the value appears as 209.157.22.0/24
(if you have enabled display of sub-net lengths) or 209.157.22.0 0.0.0.255 in the startup-config file.
If you enable the software to display IP sub-net masks in CIDR format, the mask is saved in the file in
“/<mask-bits>” format. To enable the software to display the CIDR masks, enter the ip show-subnet-length
command at the global CONFIG level of the CLI. You can use the CIDR format to configure the ACL entry
regardless of whether the software is configured to display the masks in CIDR format.
NOTE: If you use the CIDR format, the ACL entries appear in this format in the running-config and startup-config
files, but are shown with sub-net mask in the display produced by the show access-list and show ip access-list
commands.
The <destination-ip> | <hostname> parameter specifies the destination IP host for the policy. If you want the
policy to match on all destination addresses, enter any.
The <operator> parameter specifies a comparison operator for the TCP or UDP port number. This parameter
applies only when you specify tcp or udp as the IP protocol. For example, if you are configuring an entry for
HTTP, specify tcp eq http. You can enter one of the following operators:
• eq – The policy applies to the TCP or UDP port name or number you enter after eq.
• gt – The policy applies to TCP or UDP port numbers greater than the port number or the numeric equivalent
of the port name you enter after gt.
• lt – The policy applies to TCP or UDP port numbers that are less than the port number or the numeric
equivalent of the port name you enter after lt.
• neq – The policy applies to all TCP or UDP port numbers except the port number or port name you enter after
neq.
• range – The policy applies to all TCP or UDP port numbers that are between the first TCP or UDP port name
or number and the second one you enter following the range parameter. The range includes the port names
or numbers you enter. For example, to apply the policy to all ports between and including 23 (Telnet) and 53
(DNS), enter the following: range 23 53. The first port number in the range must be lower than the last
number in the range.
• established – This operator applies only to TCP packets. If you use this operator, the policy applies to TCP
packets that have the ACK (Acknowledgment) or RST (Reset) bits set on (set to “1”) in the Control Bits field of
the TCP packet header. Thus, the policy applies only to established TCP sessions, not to new sessions. See
Section 3.1, “Header Format”, in RFC 793 for information about this field.
NOTE: This operator applies only to destination TCP ports, not source TCP ports.
The <tcp/udp-port> parameter specifies the TCP or UDP port number or well-known name. The device
recognizes the following well-known names. For other ports, you must specify the port number.
NOTE: The following lists are organized alphabetically. In the CLI, these port names are listed according to
ascending port number.
• TCP port names recognized by the software:
• bgp
• dns
• ftp
• http
• imap4
• ldap
• nntp
3 - 12