By default, 10 ACL logs are generated if you do not specify the threshold explicitly.
The default frequency at which ACL logs are generated is five minutes. By default,
flow-based monitoring is not enabled.
The
monitor
option is relevant in the context of flow-based monitoring only. For
more information, refer to
Port Monitoring
.
NOTE: When ACL logging and byte counters are configured simultaneously,
byte counters may display an incorrect value. Configure packet counters with
logging instead.
permit tcp
To pass TCP packets meeting the filter criteria, configure a filter.
Z9500
Syntax
permit tcp {
source mask
| any | host
ip-address
} [
bit
]
[
operator port
[
port
]] {
destination mask
| any | host
ip-
address
} [
bit
] [dscp] [
operator port
[
port
]] [count [bytes]]
[log] [order] [monitor] [fragments]
To remove this filter, you have two choices:
• Use the
no seq
sequence-number
command if you know the filter’s
sequence number.
• Use the
no permit tcp {
source mask
| any | host
ip-address
}
{
destination mask
| any | host
ip-address
}
command.
Parameters
source
Enter the IP address of the network or host from which the
packets were sent.
mask
Enter a network mask in /prefix format (/x) or A.B.C.D. The
mask, when specified in A.B.C.D format, may be either
contiguous or non-contiguous.
any
Enter the keyword
any
to specify that all routes are subject
to the filter.
host
ip-address
Enter the keyword
host
then the IP address to specify a host
IP address.
bit
Enter a flag or combination of bits:
•
ack:
acknowledgement field
•
fin:
finish (no more data from the user)
•
psh:
push function
•
rst:
reset the connection
•
syn:
synchronize sequence numbers
•
urg:
urgent field
252
Access Control Lists (ACL)
