Reference Guide

697
FILE LOCATION: C:\Users\gina\Desktop\Checkout_new\CLI Folders\Dell Contax
CLI\files\ACL.fm
DELL CONFIDENTIAL – PRELIMINARY 2013 - FOR PROOF ONLY
• match-all list-of-flags —List of TCP flags that should occur. If a flag
should be set it is prefixed by “+”.If a flag should be unset it is prefixed by
“-”. Available options are +urg, +ack, +psh, +rst, +syn, +fin, -urg, -ack, -
psh, -rst, -syn and -fin. The flags are concatenated to a one string. For
example: +fin-ack.
• time-range-name —Name of the time range that applies to this permit
statement. (Range: 1–32)
• disable-port —The Ethernet interface is disabled if the condition is
matched.
• log-input —Specifies sending an informational syslog message about the
packet that matches the entry. Because forwarding is done in hardware and
logging is done in software, if a large number of packets match a deny ACE
containing a log-input keyword, the software might not be able to match
the hardware processing rate, and not all packets will be logged.
Default
No IPv4 access list is defined.
Command Mode
IP Access-list Configuration mode
User Guidelines
Enter IP-access list configuration mode by using the IP Access-list Global
Configuration command.
After an access control entry (ACE) is added to an access control list, an
implied deny any any condition exists at the end of the list. That is, if there
are no matches, the packets are denied. However, before the first ACE is
added, the list permits all packets.
The number of TCP/UDP ranges that can be defined in ACLs is limited. You
can define up to #ASIC-specific ranges for TCP and up to #ASIC-specific
ranges for UDP. If a range of ports is used for source port in ACE it would be
not be counted again if it is also used for source port in another ACE. If a
range of ports is used for destination port in ACE it would be not be counted
again if it is also used for destination port in another ACE.
If a range of ports is used for source port, it would be counted again if it is also
used for destination port.