The Access Control List

Standard ACL Syntax

Legacy syntax:
access-list <number> {permit | deny} <source> [log]

router(config)#access-list 10 permit ip

Modern syntax:
ip access-list standard {<number> | number}
[<sequence>] {permit | deny} <source> [log]

router(config)#ip access-list standard 10
permit ip

Extended ACL Syntax

Legacy syntax:
access-list <number> {permit | deny} <protocol> <source> [<ports>] <destination> [<ports>] [<option>]

router(config)#access-list 100 permit ip

Modern Syntax:
ip access-list extended {<number> | <number>}
[<secquence>] {permit | deny} <protocol> <source> [<ports>] <destination> [<ports>] [<option>]

router(config)#ip access-list extended 100
permit ip

ACL Numbers
1-99 IP Standard
100-199 IP extended
200-299 Protocol
300-399 DECnet
400-499 XNS
500-599 Extended XNS
600-699 Apple Talk
700-799 Ethernet MAC
800-899 IPX standard
900-999 IPX extended
1000-1099 IPX SAP
1100-1199 MAC extended
1200-1299 IPX summary
permit Allow matched packets
deny Deny matched packets
remark Record a configuration comment
evaluate Evaluate a reflexive ACL
Souce/Destination Definitions
any Any address
host <address> A single address
<network>< mask> Any address matched by the wildcard mask
IP Options
dscp Match the specified IP DSCP
fragments Check non-initial fragments
option Match the especified IP option
precedence {0-7} Match the specified IP precedence
ttl Match the specified IP time to live (TTL)
TCP/UDP Port Definitions
eq Equal to
neq Not equal to
gt Greater than
range Match a range of port numbers
TCP Options
ack Match ACK flag
fin Match FIN flag
psh Match PSH flag
rt Match RST flag
syn Match SYN flag
urg Match URG flag
established Match packets in an established session
Logging Options
log Log ACL entry matches
log-input Log matches including ingress interface and source MAC address
Miscellaneous Options
reflect <name> Create reflexive ACL entry
Applying ACLs to Restrict Traffic:
interface Fastethernet0/0
ip access-group {<number> | <name>} {in | out}

show access-lists [<number> | <name>]
show ip access-lists [<number> | <name>]
show ip access-lists interface <interface>
show ip access-lists dynamic
show ip interface [<interface>]
show time-range [<name>]


Post a Comment