80
Asanté IntraCore 36000 Series
Follow these guidelines.
Masks that include an entry for a Layer 4 protocol source port or destination port can only be applied to
packets with a header length of exactly five bytes.
Command Attributes
Src/Dst IP – Specifies the source or destination IP address. Use “Any” to match any address, “Host” to
specify a host address (not a subnet), or “IP” to specify a range of addresses. (Options: Any, Host, IP;
Default: Any)
Src/Dst IP Bitmask – Source or destination address of rule must match this bitmask. (See the description for
SubMask in section
6.7.3 Configuring a Standard IP ACL.
)
Protocol Bitmask – Check the protocol field.
Service Type – Check the rule for the specified priority type. (Options: Precedence, TOS, DSCP; Default:
TOS)
Src/Dst Port Bitmask – Protocol port of rule must match this bitmask. (Range: 0-65535)
Control Bitmask – Control flags of rule must match this bitmask. (Range: 0-63)
Configuring Switch Using the Web or CLI
Web
Configure the mask to match the required rules in the IP ingress or egress ACLs. Set the mask to check for
any source or destination address, a specific host address, or an address range. Include other criteria to
search for in the rules, such as a protocol type or one of the service types. Alternatively, use a bitmask to
search for specific protocol port(s) or TCP control code(s). Then click Add.
CLI
This shows that the entries in the mask override the precedence in which the rules are entered into the ACL.
In the following example, packets with the source address 10.1.1.1 are dropped because the “deny 10.1.1.1
255.255.255.255” rule has the higher precedence according the “mask host any” entry.
Console(config)#
access-list ip standard A2
Console(config-std-acl)#
permit 10.1.1.0 255.255.255.0
