19-10
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
Chapter 19 Configuring Network Security with ACLs
Configuring Router ACLs
Protocol (igrp), any Interior Protocol (ip), IP in IP tunneling (ipinip), KA9Q NOS-compatible IP
over IP tunneling (nos), Open Shortest Path First routing (ospf), Payload Compression Protocol
(pcp), Protocol Independent Multicast (pim), Transmission Control Protocol (tcp), or User
Datagram Protocol (udp).
Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP.
Table 19-2
lists the possible filtering parameters for ACEs for each protocol type.
For more details on the specific keywords relative to each protocol, refer to Cisco IP and IP Routing
Command Reference for IOS Release 12.1.
Note
The Catalyst 3550 switch does not support dynamic or reflexive access lists. It also does not support
filtering based on the type of service (ToS) minimize-monetary-cost bit.
When you are creating ACEs in numbered extended access lists, remember that after you create the ACL,
any additions are placed at the end of the list. You cannot reorder the list or selectively add or remove
ACEs from a numbered list.
Table 19-2 Filtering Parameter ACEs Supported by Different IP Protocols
Filtering Parameter
1
1.
X in a protocol column means support for the filtering parameter.
TCP UDP
ICMP
2
2.
ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered.
IGMP
Other IP
Layer 3 Parameters:
IP ToS byte
3
3.
No support for type of service (TOS) minimize monetary cost bit.
X
X
X
X
X
Differentiated Services Code Point (DSCP)
X
X
X
X
X
IP source address
X
X
X
X
X
IP destination address
X
X
X
X
X
Fragments
X
X
X
X
X
TCP or UDP
X
X
–
–
–
ICMP
–
–
X
–
–
IGMP
–
–
–
X
–
Other IP protocol
–
–
–
–
X
Layer 4 Parameters
Source port
X
X
–
–
–
Source port operator
X
X
–
–
–
Destination port
X
X
–
–
–
Destination port operator
X
X
–
–
–
TCP flag
X
–
–
–
–
ICMP code
–
–
X
–
–
ICMP type
–
–
X
–
–
IGMP message type
–
–
–
X
–
