IPv4 Access Control Lists (ACLs)

Configuring Extended ACLs

Port Number or Well-Known Port Name:

Use the TCP or UDP port number required by your appli­ cation. The switch also accepts these well-known TCP or UDP port names as an alternative to their port numbers:

•TCP: bgp, dns, ftp, http, imap4, ldap, nntp, pop2, pop3, smtp, ssl, telnet

•UDP: bootpc, bootps, dns, ntp, radius, radius-old, rip, snmp, snmp-trap, tftp

To list the above names, press the [Shift] [?] key combination after entering an operator. For a comprehensive listing of port numbers, visit www.iana.org/assignments/port­ numbers.

[comparison-operator < tcp-dest-port >] [established] [comparison-operator < udp-dest-port >]

This option, if used, is entered immediately after the < DA > entry. To specify a TCP or UDP port number, (1) select a comparison operator and (2) enter the port number or a well- known port name.

Comparison Operators and Well-Known Port Names —

These are the same as are used with the TCP/UDP source-port options, and are listed earlier in this command description.

[established] — This option applies only where TCP is the configured protocol type. It blocks the synchronizing packet associated with establishing a TCP connection in one direction on a VLAN while allowing all other IPv4 traffic for the same type of connection in the opposite direction. For example, a Telnet connect requires TCP traffic to move both ways between a host and the target device. Simply applying a Deny to inbound Telnet traffic on a VLAN would prevent Telnet sessions in either direction because responses to outbound requests would be blocked. However, by using the established option, inbound Telnet traffic arriving in response to outbound Telnet requests would be permitted, but inbound Telnet traffic trying to estab­ lish a connection would be denied.

9-62