Connectivity Guide

● Configure a drop or forward filter in IPV4-ACL mode.
seq sequence-number {deny | permit | remark} {ip-protocol-number | icmp | ip |
protocol | tcp | udp} {source prefix | source mask | any | host} {destination mask
| any | host ip-address} [count [byte]] [fragments]
Auto-generated sequence number
If you are creating an ACL with only one or two filters, you can let the system assign a sequence number based on the order you
configure the filters. The system assigns sequence numbers to filters using multiples of ten values.
● Configure a deny or permit filter to examine IP packets in IPV4-ACL mode.
{deny | permit} {source mask | any | host ip-address} [count [byte]] [fragments]
● Configure a deny or permit filter to examine TCP packets in IPV4-ACL mode.
{deny | permit} tcp {source mask] | any | host ip-address}} [count [byte]] [fragments]
● Configure a deny or permit filter to examine UDP packets in IPV4-ACL mode.
{deny | permit} udp {source mask | any | host ip-address}} [count [byte]] [fragments]
Assign sequence number to filter
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# seq 5 deny tcp any any capture session 1 count
View ACLs and packets processed through ACL
OS10# show ip access-lists in
Ingress IP access-list acl1
Active on interfaces :
ethernet1/1/5
seq 5 permit ip any any count (10000 packets)
Delete ACL rule
Before release 10.4.2, deleting ACL rules required a sequence number.
After release 10.4.2 or later, you can also delete ACL rules using the no form of the CLI command without using a sequence
number.
While deleting ACL rules, the following conditions apply:
● Enter the exact no form of the CLI command. Each ACL rule is an independent entity. For example, the rule, deny ip any
any is different from deny ip any any count.
For example, if you configured the following rules:
deny ip 1.1.1.1/24 2.2.2.2/24
deny ip any any
Using the no deny ip any any command deletes only the deny ip any any rule.
To delete the deny ip 1.1.1.1/24 2.2.2.2/24 rule, you must explicitly use the no deny ip 1.1.1.1/24
2.2.2.2/24 command.
NOTE: Wildcard option is not supported.
● You can no longer configure the same ACL rule multiple times using different sequence numbers. This option prevents
duplicate rules from being entered in the system and taking up memory space.
● When you upgrade from a previous release to release 10.4.2 or later, the upgrade procedure removes all duplicate ACL rules
and only one instance of an ACL rule remains in the system.
844
Access Control Lists