User Manual

Table Of Contents
NETGEAR M4500 Series Switches CLI Command Reference Manual 557
Default None
Mode IP-Access-List Config
eq {<0-65535> | <portkey>}
Specifies the layer 4 port match condition for the IP ACL rule. A port number can
be used, in the range 0- 65535, or the portkey, which can be one of the
following keywords:
• For TCP: bgp, domain, echo, ftp, ftp-data, http, smtp, telnet, www, pop2,
pop3
• For UDP: domain, echo, ntp, rip, snmp, tftp, time, who.
flag [+fin | -fin] [+syn | -syn]
[+rst | -rst] [+psh | -psh]
[+ack | -ack] [+urg | -urg]
[established]
Specifies that the IP ACL rule matches on the tcp flags. When +<tcpflagname> is
specified, a match occurs if specified <tcpflagname> flag is set in the TCP
header. When “-<tcpflagname>” is specified, a match occurs if specified
<tcpflagname> flag is *NOT* set in the TCP header. When established is
specified, a match occurs if specified either RST or ACK bits are set in the TCP
header. Two rules are installed in hardware to when “established” option is
specified. This option is visible only if protocol is “tcp”.
dscp <value>
Specifies the dscp value to match for for the IP rule. The value range from 0 to
63 or a DSCP keyword (af11, af12, af13, af21, af22, af23, af31, af32, af33, af41,
af42, af43, be, cs0, s1, cs2, cs3, cs4, cs5, cs6, cs7, ef).
flow-label <vlaue>
Specifies the flow-label value to match for for the IP rule. The value range from
0 to 1048575.
icmp-type <icmp-type>
[icmp-code <icmp-code> |
icmp-message <icmp-
message>]
This option is available only if the protocol is ICMP.
Specifies a match condition for ICMP packets.
When icmp-type is specified, the IP ACL rule matches on the specified ICMP
message type, a number from 0 to 255.
When icmp-code is specified, the IP ACL rule matches on the specified ICMP
message code, a number from 0 to 255.
Specifying icmp-message implies that both icmp-type and icmp-code are
specified. The following icmp-messages are supported: destination-
unreachable, echo-reply, echo-request, header, hop-limit, mld-query, mld-
reduction, mld-report, nd-na, nd-ns, next-header, no-admin, no-route, packet-
too-big, port-unreachable, router-solicitation, router-advertisement, router-
renumbering, time-exceeded, and unreachable.
The ICMP message is decoded into the corresponding ICMP type and ICMP code
within that ICMP type.
[fragments]
Specifies that IP ACL rule matches on fragmented IP packets.
[routing]
Specifies that IP ACL rule matches on IP packets that have the routing extension
header.