ECS3510-26P_Management Guide R02

C HAPTER 25 | Access Control Lists
IPv4 ACLs
– 716 –
For example, use the code value and mask below to catch packets with
the following flags set:
■
SYN flag valid, use “control-code 2 2”
■
Both SYN and ACK valid, use “control-code 18 18”
■
SYN valid and ACK invalid, use “control-code 2 18”
◆ Due to a ASIC limitation, the switch only checks the leftmost six priority
bits. This presents no problem when checking DSCP or IP Precedence
bits, but limits the checking of ToS bits (underlined in the following
example) to the leftmost three bits, ignoring the rightmost fourth bit.
For example, if you configured an access list to deny packets with a ToS
of 7 (000011
10), the highlighted bit would be ignored, and the access
list would drop packets with a ToS of both 6 and 7.
EXAMPLE
This example accepts any incoming packets if the source address is within
subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule
(10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 &
255.255.255.0), the packet passes through.
Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any
Console(config-ext-acl)#
This allows TCP packets from class C addresses 192.168.1.0 to any
destination address when set for destination TCP port 80 (i.e., HTTP).
Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any destination-port
80
Console(config-ext-acl)#
This permits all TCP packets from class C addresses 192.168.1.0 with the
TCP control code set to “SYN.”
Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-
flag 2 2
Console(config-ext-acl)#
RELATED COMMANDS
access-list ip (712)
Time Range (572)
Table 88: Priority Bits Processed by Extended IPv4 ACL
DSCP
Precedence ToS
76543210