Cisco Catalyst 2960 Series, Configuration Manual

Page: 1321 / 2288

Purpose Command or Action
Example:
Device(config-ext-nacl)# deny ip any any option
traceroute
• Use the option keyword and option-value argument to
filter packets that contain a particular IP Option.
• In this example, any packet that contains the traceroute
IP option will be filtered out.
• Use the no sequence-number form of this command to
delete an entry.
Specifies a
permit
statement in named IP access list mode. [ sequence-number ]
permit protocol source
source-wildcard destination destination-wildcard
Step 5
• In this example, any packet (not already filtered) that
contains the security IP option will be permitted.
[ option option-value ] [ precedence precedence ] [ tos
tos ] [ log ] [ time-range time-range-name ] [ fragments ]
Example:
Device(config-ext-nacl)# permit ip any any
option security
• Use the no sequence-number form of this command to
delete an entry.
Allows you to revise the access list. Repeat Step 4 or Step 5 as necessary.
Step 6
(Optional) Exits named access list configuration mode and
returns to privileged EXEC mode. end
Example:
Device(config-ext-nacl)# end
Step 7
(Optional) Displays the contents of the IP access list.
show ip access-lists access-list-name
Example:
Device# show ip access-lists mylist1
Step 8
Filtering Packets That Contain TCP Flags
This task configures an access list to filter packets that contain TCP flags and verifies that the access list has
been configured correctly.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1239
How to Configure ACL Support for Filtering IP Options