Cisco Systems 3750E manual 34-13

Chapter 34 Configuring Network Security with ACLs

Configuring IPv4 ACLs

	Command	Purpose
or	access-listaccess-list-number	In access-list configuration mode, define an extended IP access list using an
	{deny permit} protocol any any	abbreviation for a source and source wildcard of 0.0.0.0 255.255.255.255 and
	[precedence precedence] [tos tos]	an abbreviation for a destination and destination wildcard of 0.0.0.0
	[fragments] [log] [log-input]	255.255.255.255.
	[time-rangetime-range-name]	You can use the any keyword in place of source and destination address and
	[dscp dscp]
		wildcard.
or	access-listaccess-list-number	Define an extended IP access list by using an abbreviation for a source and a
	{deny permit} protocol	source wildcard of source 0.0.0.0 and an abbreviation for a destination and
	host source host destination	destination wildcard of destination 0.0.0.0.
	[precedence precedence] [tos tos]	You can use the host keyword in place of the source and destination wildcard
	[fragments] [log] [log-input]	or mask.
	[time-rangetime-range-name]
	[dscp dscp]
Step
	access-listaccess-list-number	(Optional) Define an extended TCP access list and the access conditions.
2b	{deny permit} tcp source	Enter tcp for Transmission Control Protocol.
	source-wildcard [operator port]
		The parameters are the same as those described in Step 2a, with these
	destination destination-wildcard
	[operator port] [established]	exceptions:
	[precedence precedence] [tos tos]	(Optional) Enter an operator and port to compare source (if positioned after
	[fragments] [log] [log-input]	source source-wildcard) or destination (if positioned after destination
	[time-rangetime-range-name]
		destination-wildcard) port. Possible operators include eq (equal), gt (greater
	[dscp dscp] [flag]
		than), lt (less than), neq (not equal), and range (inclusive range). Operators
		require a port number (range requires two port numbers separated by a space).
		Enter the port number as a decimal number (from 0 to 65535) or the name of a
		TCP port. To see TCP port names, use the ? or see the “Configuring IP Services”
		section in the “IP Addressing and Services” chapter of the Cisco IOS IP
		Configuration Guide, Release 12.2. Use only TCP port numbers or names when
		filtering TCP.
		The other optional keywords have these meanings:
		• established—Enter to match an established connection. This has the same
		function as matching on the ack or rst flag.
		• flag—Enter one of these flags to match by the specified TCP header bits:
		ack (acknowledge), fin (finish), psh (push), rst (reset), syn (synchronize),
		or urg (urgent).
Step	access-listaccess-list-number	(Optional) Define an extended UDP access list and the access conditions.
2c	{deny permit} udp	Enter udp for the User Datagram Protocol.
	source source-wildcard [operator
		The UDP parameters are the same as those described for TCP except that the
	port] destination
	destination-wildcard [operator	[operator [port]] port number or name must be a UDP port number or name, and
	port] [precedence precedence]	the flag and established parameters are not valid for UDP.
	[tos tos] [fragments] [log]
	[log-input][time-range
	time-range-name] [dscp dscp]

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		34-13