Concept Guide

seq 50 permit tcp 10.8.0.0 /16 10.50.188.118 /31 eq 49
seq 55 permit udp 10.15.1.0 /24 10.50.188.118 /31 range 1812 1813
To delete a lter, enter the show config command in IP ACCESS LIST mode and locate the sequence number of the lter you want to
delete. Then use the no seq sequence-number command in IP ACCESS LIST mode.
Congure an Extended IP ACL
Extended IP ACLs lter on source and destination IP addresses, IP host addresses, TCP addresses, TCP host addresses, UDP addresses,
and UDP host addresses.
Because trac passes through the lter in the order of the lter’s sequence, you can congure the extended IP ACL by rst entering IP
ACCESS LIST mode and then assigning a sequence number to the lter.
Conguring Filters with a Sequence Number
To congure lters with a sequence number, use the following commands.
1 Enter IP ACCESS LIST mode by creating an extended IP ACL.
CONFIGURATION mode
ip access-list extended access-list-name
2 Congure a drop or forward lter.
CONFIG-EXT-NACL mode
seq sequence-number {deny | permit} {ip-protocol-number | icmp | ip | tcp | udp} {source mask
| any | host ip-address} {destination mask | any | host ip-address} [operator port [port]]
[count [byte]] [order] [fragments]
When you create the lters with a specic sequence number, you can create the lters in any order and the lters are placed in the correct
order.
NOTE
: When assigning sequence numbers to lters, you might need to insert a new lter. To prevent reconguring multiple
lters, assign sequence numbers in multiples of ve or another number.
The following examples shows how the seq command orders the lters according to the sequence number assigned. In the example, lter
15 was congured before lter 5, but the show config command displays the lters in the correct order.
Dell(conf-ext-nacl)#seq 15 deny ip host 112.45.0.0 any
Dell(conf-ext-nacl)#seq 5 permit tcp 12.1.3.45 255.255.0.0 any
Dell(conf-ext-nacl)#show config
!
ip access-list extended dilling
seq 5 permit tcp 12.1.0.0 255.255.0.0 any
seq 15 deny ip host 112.45.0.0 any
Dell(conf-ext-nacl)#
Conguring Filters Without a Sequence Number
If you are creating an extended ACL with only one or two lters, you can let the system assign a sequence number based on the order in
which the lters are congured. The system assigns lters in multiples of ve.
To congure a lter for an extended IP ACL without a specied sequence number, use any or all of the following commands:
• Congure a deny or permit lter to examine IP packets.
CONFIG-EXT-NACL mode
{deny | permit} {source mask | any | host ip-address} [count [byte]] [order] [fragments]
• Congure a deny or permit lter to examine TCP packets.
CONFIG-EXT-NACL mode
118
Access Control Lists (ACLs)