Product guide

10-68
Access Control Lists (ACLs)
Configuring Extended ACLs
Options for TCP and UDP Traffic in Extended ACLs. An ACE designed
to permit or deny TCP or UDP traffic can optionally include port number
criteria for either the source or destination, or both. Use of TCP criteria also
allows the established option for controlling TCP connection traffic. (For a
summary of the extended ACL syntax options, refer to table 10-10 on page
10-60.)
Syntax: < deny | permit > < tcp | udp >
< SA > [comparison-operator < tcp/udp-src-port >]
< DA >
[comparison-operator < tcp-dest-port >] [established]
[comparison-operator < udp-dest-port >]
In an extended ACL using either tcp or udp as the IP packet
protocol type, you can optionally use TCP or UDP source and/
or destination port numbers or ranges of numbers to further
define the criteria for a match. For example:
#
deny tcp host 10.20.10.17 eq 23 host 10.20.10.155
established
#permit tcp host 10.10.10.100 host 10.20.10.17
eq telnet
#deny udp 10.30.10.1/24 host 10.20.10.17 range
161 162
[comparison-operator < tcp/udp-src-port >]
To specify a TCP or UDP source
port number in an ACE, (1)
select a comparison operator from the following list and (2)
enter the port number or a well-known port name.
Comparison Operators:
• eq < tcp/udp-port-nbr > — “Equal To”; to have a match with the
ACE entry, the TCP or UDP source port number in a packet
must be equal to < tcp/udp-port-nbr >.
• gt < tcp/udp-port-nbr > — “Greater Than”; to have a match with
the ACE entry, the TCP or UDP source port number in a
packet must be greater than < tcp/udp-port-nbr >.
• lt < tcp/udp-port-nbr > — “Less Than”; to have a match with the
ACE entry, the TCP or UDP source port number in a packet
must be less than < tcp/udp-port-nbr >.
• neq < tcp/udp-port-nbr> — “Not Equal”; to have a match with
the ACE entry, the TCP or UDP source port number in a
packet must not be equal to < tcp/udp-port-nbr >.
• range < start-port-nbr > < end-port-nbr > — For a match with the
ACE entry, the TCP or UDP source-port number in a packet
must be in the range <start-port-nbr >
< end-port-nbr >.