ECS4110-52P_Management Guide

C HAPTER 26 | Access Control Lists
IPv4 ACLs
– 974 –
For example, if you configured an access list to deny packets with a ToS
of 7 (000011
10), the highlighted bit would be ignored, and the access
list would drop packets with a ToS of both 6 and 7.
EXAMPLE
This example accepts any incoming packets if the source address is within
subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule
(10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 &
255.255.255.0), the packet passes through.
Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any
Console(config-ext-acl)#
This allows TCP packets from class C addresses 192.168.1.0 to any
destination address when set for destination TCP port 80 (i.e., HTTP).
Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any destination-port
80
Console(config-ext-acl)#
This permits all TCP packets from class C addresses 192.168.1.0 with the
TCP control code set to “SYN.”
Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-
flag 2 2
Console(config-ext-acl)#
RELATED COMMANDS
access-list ip (970)
Time Range (782)
Table 108: Priority Bits Processed by Extended IPv4 ACL
DSCP
Precedence ToS
76543210