Users Guide

To view all congured IP ACLs, use the show ip accounting access-list command in EXEC Privilege mode.
Dell#show ip accounting access example interface gig 4/12
Extended IP access list example
seq 15 deny udp any any eq 111
seq 20 deny udp any any eq 2049
seq 25 deny udp any any eq 31337
seq 30 deny tcp any any range 12345 12346
seq 35 permit udp host 10.21.126.225 10.4.5.0 /28
seq 40 permit udp host 10.21.126.226 10.4.5.0 /28
seq 45 permit udp 10.8.0.0 /16 10.50.188.118 /31 range 1812 1813
seq 50 permit tcp 10.8.0.0 /16 10.50.188.118 /31 eq 49
seq 55 permit udp 10.15.1.0 /24 10.50.188.118 /31 range 1812 1813
To delete a lter, enter the show config command in IP ACCESS LIST mode and locate the sequence number of the lter you want to
delete. Then use the no seq sequence-number command in IP ACCESS LIST mode.
Congure an Extended IP ACL
Extended IP ACLs lter on source and destination IP addresses, IP host addresses, TCP addresses, TCP host addresses, UDP addresses,
and UDP host addresses.
Because trac passes through the lter in the order of the lter’s sequence, you can congure the extended IP ACL by rst entering IP
ACCESS LIST mode and then assigning a sequence number to the lter.
Conguring Filters with a Sequence Number
To congure lters with a sequence number, use the following commands.
1 Enter IP ACCESS LIST mode by creating an extended IP ACL.
CONFIGURATION mode
ip access-list extended access-list-name
2 Congure a drop or forward lter.
CONFIG-EXT-NACL mode
seq sequence-number {deny | permit} {ip-protocol-number | icmp | ip | tcp | udp} {source mask
| any | host ip-address} {destination mask | any | host ip-address} [operator port [port]]
[count [byte]] [order] [fragments]
When you create the lters with a specic sequence number, you can create the lters in any order and the lters are placed in the correct
order.
NOTE
: When assigning sequence numbers to lters, you might need to insert a new lter. To prevent reconguring multiple
lters, assign sequence numbers in multiples of ve or another number.
The following examples shows how the seq command orders the lters according to the sequence number assigned. In the example, lter
15 was congured before lter 5, but the
show config command displays the lters in the correct order.
Dell(conf-ext-nacl)#seq 15 deny ip host 112.45.0.0 any
Dell(conf-ext-nacl)#seq 5 permit tcp 12.1.3.45 255.255.0.0 any
Dell(conf-ext-nacl)#show config
!
ip access-list extended dilling
seq 5 permit tcp 12.1.0.0 255.255.0.0 any
seq 15 deny ip host 112.45.0.0 any
Dell(conf-ext-nacl)#
118
Access Control Lists (ACLs)