Service Manual

Related
Commands
• ip access-list extended — create an extended ACL.
•
• permit tcp — assign a permit filter for TCP packets.
• permit udp — assign a permit filter for UDP packets.
permit tcp
To pass TCP packets meeting the filter criteria, configure a filter.
Syntax
permit tcp {source mask | any | host ip-address} [bit] [operator
port [port]] {destination mask | any | host ip-address} [bit]
[dscp] [operator port [port]] [count [byte] [order] [fragments]
[no-drop]
To remove this filter, you have two choices:
• Use the no seq sequence-number command if you know the filter’s sequence
number.
• Use the no permit tcp {source mask | any | host ip-address}
{destination mask | any | host ip-address} command.
Parameters
source Enter the IP address of the network or host from which the
packets were sent.
mask Enter a network mask in /prefix format (/x) or A.B.C.D. The mask,
when specified in A.B.C.D format, may be either contiguous or
non-contiguous.
any Enter the keyword any to specify that all routes are subject to
the filter.
host ip-address Enter the keyword host then the IP address to specify a host IP
address.
bit Enter a flag or combination of bits:
• ack: acknowledgement field
• fin: finish (no more data from the user)
• psh: push function
• rst: reset the connection
• syn: synchronize sequence numbers
• urg: urgent field
dscp Enter the keyword dscp to deny a packet based on the DSCP
value. The range is from 0 to 63.
operator (OPTIONAL) Enter one of the following logical operand:
• eq = equal to
Access Control Lists (ACL) 270