Specifications

access-list (extended)
21-72 Security Configuration
Usage
ValidaccesslistnumbersforstandardACLsare1to99.ForextendedACLs,validvaluesare100
to199.
Accesslistsareappliedtointerfacesbyusingthe
ipaccess‐groupcommand(“ipaccess‐group”
onpage 21‐74).
Examples
Thisexampleshowshowtocreateaccesslist1withthreeentriesthatallowaccesstoonlythose
hostsonthethreespecifiednetworks.Thewildcardbitsapplytothehostportionsofthenetwork
addresses.Anyhostwithasourceaddressthatdoesnotmatchtheaccesslistentrieswill
be
rejected:
C3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
C3(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255
C3(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255
Thisexamplemovesentry16tothebeginningofACL22:
C3(su)->router(Config)#access-list 22 move 1 16
access-list (extended)
UsethiscommandtodefineanextendedIPaccesslistbynumberwhenoperatinginroutermode.
Thenoformofthiscommandremovesthedefinedaccesslistorentry:
Syntax
To apply ACL restrictions to IP, UDP, ICMP or TCP packets:
access-list access-list-number {deny | permit} protocol source [source-wildcard]
[operator [port]] destination [destination-wildcard]
no access-list access-list-number [entry]
To insert or replace an ACL entry:
access-list access-list-number insert | replace entry
To move entries within an ACL:
access-list access-list-number move destination source1 [source2]
Parameters
access‐list‐number Specifiesanextendedaccesslistnumber.Validvaluesarefrom100to199.
deny|permit Deniesorpermitsaccessifspecifiedconditionsaremet.
protocol SpecifiesanIPprotocolforwhichtodenyorpermitaccess.Validvalues
andtheircorrespondingprotocolsare:
•ip‐AnyInternetprotocol
• udp‐User
DatagramProtocol
• tcp‐TransmissionControlProtocol
• icmp‐InternetControlMessageProtocol