Filter
Top Products
A
CCESS
C
ONTROL
L
IST
C
OMMANDS
4-121
permit, deny (Extended ACL)
This command adds a rule to an Extended IP ACL. The rule sets a filter
condition for packets with specific source or destination IP addresses,
protocol types, source or destination protocol ports, or TCP control codes.
Use the no form to remove a rule.
Syntax
[no] {permit | deny} [protocol-number | udp]
{any | source address-bitmask | host source}
{any | destination address-bitmask | host destination}
[precedence precedence] [tos tos] [dscp dscp]
[source-port source-port [bitmask]] [destination-port destination-port
[port-bitmask]]
[no] {permit | deny} tcp
{any | source address-bitmask | host source}
{any | destination address-bitmask | host destination}
[precedence precedence] [tos tos] [dscp dscp]
[source-port source-port [bitmask]] [destination-port destination-port
[port-bitmask]]
[control-flag control-flags flag-bitmask]
• protocol-number – A specific protocol number. (Range: 0-255)
• source – Source IP address.
• destination – Destination IP address.
• address-bitmask – Decimal number representing the address bits to
match.
• host – Keyword followed by a specific IP address.
• precedence – IP precedence level. (Range: 0-7)
• tos – Type of Service level. (Range: 0-15)
• dscp – DSCP priority level. (Range: 0-63)
• source-port – Protocol
16
source port number. (Range: 0-65535)
• destination-port – Protocol
16
destination port number.
(Range: 0-65535)
• port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
16. Includes TCP, UDP or other protocol types.