10G Core Routing Switch User Manual
陈泽科技有限公司
- - 81 - -
www.stephen-tele.com
Step 2b
rule
rule_id
{
deny
|
permit
}
tcp
sip
ip-address net-mask
dip
ip-address net-mask
[
sport
port
] [d
sport
port
]
[
established
]
[
match
[
dscp
priority
|
precedence
priority
|
tos
priority
]] [
set
[
dscp
priority
|
precedence
priority
|
tos
priority
]]
(Optional) Define an extended TCP access list rule and
the access conditions.
Enter
tcp
for Transmission Control Protocol.
The parameters are the same as those described in
Step 2a, with these exceptions:
(Optional) Enter an sport and dport
to compare
source (if positioned after
sip
) or destination (if positioned after dip) port.
Enter the
port
number as a decimal number (from 0 to
65535) or the name of a
The other optional keywords have these meanings:
• established
—Enter to match an established
connection. This has the same function as matching on
the
ack
or
rst
flag.
•
flag—
Enter one of these flags to match by the
specified TCP header bits:
ack
(acknowledge),
fin
(finish),
psh
(push),
rst
(reset),
syn
(synchronize), or
urg
(urgent).
Step 2c
rule
rule_id
{
deny
|
permit
}
udp
sip
ip-address net-mask
dip
ip-address net-mask
[
sport
port
] [d
sport
port
] [
match
[
dscp
priority
|
precedence
priority
|
tos
priority
]] [
set
[
dscp
priority
|
precedence
priority
|
tos
priority
]]
(Optional) Define an extended UDP access list rule and
the access conditions.
Enter
udp
for the User Datagram Protocol.
The UDP parameters are the same as those described
for TCP except that the
[sport/dport] port number or name must be a UDP
port number or name, and
the
flag
and
establish
.
Step 3
show
access-list
access-list-number
Verify your entries.
Step 4
Copy
running-config
startup-config
(Optional) Save your entries in the configuration file.
To delete an ACL, use
no access-list
access-list-number
global configuration command.
To delete an extended ACL rule, use
no rule
rule_id
standard ACL configuration command.
Applying an ACL to an Interface
Beginning in privileged EXEC mode, follow these steps to control access to an interface:
Command
Purpose
Step 1
config terminal
Enter global configuration mode.
Step 2
Interface
interface_id
Enter interface configuration mode for the physical
interface to be configured.
