Extended Access List #>entry <id> label <value>
Example:
Extended Access List 100>entry 3 label 12
Extended Access List 100>
2.5.2.10 ENTRY <id> PRECEDENCE
Establishes the Access Control sentence based on the value of the precedence field for the IP packet Type of Ser-
vice byte. This can take values between 0 and 7.
Syntax:
Extended Access List #>entry <id> precedence <value>
Example:
Extended Access List 100>entry 3 precedence 3
Extended Access List 100>
2.5.2.11 ENTRY <id> TCP-SPECIFIC ESTABLISHED
Sets the Access Control sentence for the TCP packets based on whether the TCP session had been previously es-
tablished or not. To find out if a TCP session is already established, check that the ACK or the RST bit in the TCP
packet header is present. If one of the two is there, then the session is considered established.
Syntax:
Extended Access List #>entry <id> tcp-specific established-state
Example:
The following configuration shows an access list where all the TCP sessions established in entry 1 match.
entry 1 default
entry 1 permit
entry 1 protocol tcp
entry 1 tcp-specific established-state
2.5.2.12 ENTRY <id> TOS-OCTET
Establishes the Access Control sentence based on the value of the IP packet Type of Service byte. This can take
values between 0 and 255. You can also specify a bits mask that determines the Type of Service byte bits you wish
to mark. The mask value can be between 1 and 255.
Syntax:
Extended Access List #>entry <id> tos-octet <value> [mask <mask>]
Example:
Extended Access List 100>entry 3 tos-octet 240 mask 254
Extended Access List 100>
2.5.2.13 ENTRY <id> CONNECTION
Associates the connection identifier between interfaces to an entry in the Access Control List. This connection identi-
fies the logical interface through which the packet is routed (configured in the IP rules). On establishing this relation,
you can also associate the traffic (not just through the packet source or destination address etc., but also through the
specific interface connection).
Leaving the connection unspecified (or setting a zero connection) means that the connection will not consider this
parameter when executing Access Control.
A question mark will appear next to the connection (e.g. Conn:?) if this does not exist when you list the entry.
Syntax:
Extended Access List #>entry <id> connection <value>
Example:
Supposing we have the following rule defined in IP:
bintec elmeg
2 Configuration
Access Control
19
