IPv4 Access Control Lists (ACLs)

Configuring Standard ACLs

Creating or Adding to an Standard, Numbered ACL. This command is an alternative to using ip access-list standard < name-str > and does not use the “Named ACL” (nacl) context. For a standard ACL syntax summary, refer to table 9-6 on page 9-44.

Syntax: access-list < 1-99 > < deny permit >

< any host < SA > SA < mask SA/mask-length>> [log]

Appends an ACE to the end of the list of ACEs in the current IPv4 standard, numbered ACL. If the ACL does not already exist, creates both the ACL and its first ACE. In the default configuration, ACEs are automatically assigned consecutive sequence numbers in increments of 10 and can be renumbered using resequence (page 9-80).

Note: To insert a new ACE between two existing ACEs in a standard, numbered ACL:

a.Use ip access list extended < 1 - 99 > to open the ACL as a named ACL.

b.Enter the desired sequence number along with the ACE keywords and variables you want.

(After a numbered ACL has been created, it can be managed as either a named or numbered ACL. Refer to the “Numbered ACLs” list item on page 9-42.)

< 1-99 >

Specifies the ACL identifier as a number. The switch interprets an ACL with a value in this range as a standard ACL (which filters all IPv4 traffic on the basis of SA). (To create a standard access list with an alphanumeric name (name-str) instead of a number, refer to “Configuring Named, Standard ACLs” on page 9-46.)

< deny permit >

Specifies whether the ACE denies or permits a packet matching the criteria in the ACE, as described next.

9-50