Users Guide

• Clear IPv6 access-list counters in EXEC mode.
clear ipv6 access-list counters access-list-name
• Clear MAC access-list counters in EXEC mode.
clear mac access-list counters access-list-name
IP prex-lists
IP prex-lists control the routing policy. An IP prex-list is a series of sequential lters that contain a matching criterion and an permit or
deny action to process routes. The lters process in sequence so that if a route prex does not match the criterion in the rst lter, the
second lter applies, and so on.
A route prex is an IP address pattern that matches on bits within the IP address. The format of a route prex is A.B.C.D/x, where
A.B.C.D is a dotted-decimal address and /x is the number of bits that match the dotted decimal address.
When the route prex matches a lter, the system drops or forwards the packet based on the lter’s designated action. If the route prex
does not match any of the lters in the prex-list, the route drops, an implicit deny.
For example, in 112.24.0.0/16, the rst 16 bits of the address 112.24.0.0 match all addresses between 112.24.0.0 to
112.24.255.255. Use permit or deny lters for specic routes with the le (less or equal) and ge (greater or equal) parameters, where
x.x.x.x/x represents a route prex:
• To deny only /8 prexes, enter deny x.x.x.x/x ge 8 le 8
• To permit routes with the mask greater than /8 but less than /12, enter permit x.x.x.x/x ge 8 le 12
• To deny routes with a mask less than /24, enter deny x.x.x.x/x le 24
• To permit routes with a mask greater than /20, enter permit x.x.x.x/x ge 20
The following rules apply to prex-lists:
• A prex-list without permit or deny lters allows all routes
• An implicit deny is assumed — the route drops for all route prexes that do not match a permit or deny lter
• After a route matches a lter, the lter’s action applies and no additional lters apply to the route
Use prex-lists in processing routes for routing protocols such as open shortest path rst (OSPF), route table manager (RTM), and border
gateway protocol (BGP).
To congure a prex-list, use commands in PREFIX-LIST and ROUTER-BGP modes. Create the prex-list in PREFIX-LIST mode and assign
that list to commands in ROUTER-BGP modes.
Route-maps
Route-maps are a series of commands that contain a matching criterion and action. They change the packets meeting the matching
criterion. ACLs and prex-lists can only drop or forward the packet or trac while route-maps process routes for route redistribution. For
example, use a route-map to lter only specic routes and to add a metric.
• Route-maps also have an implicit deny. Unlike ACLs and prex-lists where the packet or trac drops, if a route does not match the
route-map conditions, the route does not redistribute.
• Route-maps process routes for route redistribution. For example, to add a metric, a route-map can lter only specic routes. If the route
does not match the conditions, the route-map decides where the packet or trac drops. The route does not redistribute if it does not
match.
• Route-maps use commands to decide what to do with trac. To remove the match criteria in a route-map, use the no match
command.
• In a BGP route-map, if you repeat the same match statements; for example, a match metric, with dierent values in the same sequence
number, only the last match and set values are taken into account.
Access Control Lists
1043