User Manual

action : Action for the access condition
Setting value Description
deny
Specifies "deny" as the action for the access
condition
permit
Specifies "permit" as the action for the access
condition
protocol : Applicable protocol type
Setting value Description
<0 - 255> Protocol number of the IP header
any All IPv4 packets
tcp TCP packets
udp UDP packets
src-info : Transmission-source IPv4 address that is the condition
Setting value Description
A.B.C.D E.F.G.H
Specifies the condition as an IPv4 address
(A.B.C.D) with wildcard bits (E.F.G.H)
any
Don't specify the transmission-source IPv4
address (accept all IPv4 address)
dst-info : Transmission-destination IPv4 address that will be the condition
The method of specifying this is the same as when specifying the transmission-source IPv4 address
(src-info)
[Input mode]
global configuration mode
[Description]
Generates an extended IPv4 access list.
An extended IPv4 access list is useful when you want to filter with more detail (specific protocols + destination information)
than the standard IPv4 access list.
When generating a list, you can either specify a defined ID or assign a desired name.
If you want to apply this to traffic classification conditions, execute the match access-group command in class map mode.
For a single ID, you can repeat this to make up to 30 registrations.
[Note]
In order to execute this command, QoS must be enabled.
An error occurs if the maximum number of registrations is exceeded, or if you specify content that is already registered.
The extended IPv4 access list IDs are shared with the MAC access list IDs. An error occurs if you use an ID that is specified for
a MAC access list.
[Example]
Create extended IPv4 access list #100 which permits traffic from the transmission-source 192.168.1.0/24 segment and
192.168.2.0/24 segment to 10.1.1.1
SWP1(config)#ip-access-list 100 permit any 192.168.1.0 0.0.0.255 host 10.1.1.1
SWP1(config)#ip-access-list 100 permit any 192.168.2.0 0.0.0.255 host 10.1.1.1
Create extended IP access list "TEST" which permits traffic from the 192.168.1.0/24 segment and 192.168.2.0/24 segment to
10.1.1.1
SWP1(config)#ip-access-list extended TEST permit any 192.168.1.0 0.0.0.255 host
10.1.1.1
SWP1(config)#ip-access-list extended TEST permit any 192.168.2.0 0.0.0.255 host
10.1.1.1
196 | Command Reference | Traffic control