Configuring Access Control Lists 619
continued
– When “gt” is specified, IPv6 ACL rule matches if the
layer 4 destination port number is greater than the
specified port number or portkey. It is equivalent to
specifying the range as <specified port number + 1>
to 65535.
– When “neq” is specified, IPv6 ACL rule matches only if
the layer 4 destination port number is not equal to the
specified port number or portkey.
– IPv6 TCP port names:
bgp, domain, echo, ftp, ftp-
data, http, smtp, telnet, www, pop2, pop3
–IPv6 UDP port names:
domain, echo, ntp, rip, snmp,
time, who
•
destination-ipv6-prefix
/
prefix-length
|
any
|
host
destination-ipv6-address
—Specifies a destination IP
address and netmask for match condition of the IP ACL
rule.
– For IPv6 ACLs, “any” implies 0::/128 prefix and a mask
of all ones.
– Specifying host implies prefix length as “/128” and a
mask of 0::/128.
• [precedence
precedence
| tos
tos
[
tosmask
] | dscp
dscp
]—Specifies the TOS for an IP/TCP/UDP ACL rule
depending on a match of precedence or DSCP values
using the parameters dscp, precedence, or tos tosmask.
• flag [+fin | -fin] [+syn | -syn] [+rst | -rst] [+psh | -
psh] [+ack | -ack] [+urg | -urg] [established]—Specifies
that the IP/TCP/UDP ACL rule matches on the TCP
flags.
– When “+<tcpflagname>
” is
specified, a match occurs
if specified <tcpflagname> flag is set in the TCP
header.
– When “-<tcpflagname>
” is
specified, a match occurs
if specified <tcpflagname> flag is *NOT* set in the
TCP header.
– When “established
” is
specified, a match occurs if
specified either RST or ACK bits are set in the TCP
header.
Command Purpose