Enterasys G3G170-24, Cli Reference Manual

Page: 674 / 679

access-list (extended)
20-72 Security Configuration
Defaults
If insert, replace or move are not specified, the new entry will be appended to the access list.
If source2 is not specified with move , only one entry will be moved.
Mode
Global configuration: G3(su) ‐ >router(Config)#
Usage
Valid access list numbers for standard ACLs are 1 to 99 . For extended ACLs, valid values are 100
to 199 .
Access lists are applied to interfaces by using the ip access ‐ group command (“ ip access ‐ group ”
on page 20 ‐ 74).
Examples
This example shows how to create access list 1 with three entries that allow access to only those
hosts on the three specified networks. The wildcard bits apply to the host portions of the network
addresses. Any host with a source address that does not match the access list entries will be
rejected:
G3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
G3(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255
G3(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255
This example moves entry 16 to the beginning of ACL 22:
G3(su)->router(Config)#access-list 22 move 1 16
access-list (extended)
Use this command to define an extended IP access list by number when operating in router mode.
The no form of this command removes the defined access list or entry:
Syntax
To apply ACL restrictions to IP, UDP, ICMP or TCP packets:
access-list access-list-number { deny | permit } protocol source [ source-wildcard ]
[ operator [ port ]] destination [ destination-wildcard ]
no access-list access-list-number [ entry ]
move destination
source1 source2
(Optional) Moves a sequence of access list entries before another entry.
Destination is the number of the existing entry before which this new entry
will be moved. Source1 is a single entry number or the first entry number in
the range to be moved. Source2 (optional) is the last entry number in the
range to be moved. If source2 is not specified, only the source1 entry will be
moved.
Note: ACLs are not supported on routed VLANs which incorporate LAG ports.