Creating Ip Extended Acls - Cisco ME 3400 Software Configuration Manual

Configuring QoS
This example shows how to allow access for only those hosts on the three specified networks. The
wildcard bits apply to the host portions of the network addresses.
Switch(config)# access-list 1 permit 192.5.255.0 0.0.0.255
Switch(config)# access-list 1 permit 128.88.0.0 0.0.255.255
Switch(config)# access-list 1 permit 36.0.0.0 0.0.0.255

Creating IP Extended ACLs

Beginning in privileged EXEC mode, follow these steps to create an IP extended ACL for IP traffic:
Command
Step 1 configure terminal
Step 2 access-list access-list-number permit
protocol {source source-wildcard
destination destination-wildcard}
[precedence precedence] [tos tos] [dscp
dscp]
Note If you enter a dscp value, you
cannot enter tos or precedence.
You can enter both a tos and a
precedence value with no dscp.
or ip access-list extended name
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
33-32
Purpose
Enter global configuration mode.
Create an IP extended ACL. Repeat the step as many times as necessary.
For access-list-number, enter the access list number. The range is
•
100 to 199 and 2000 to 2699.
Always use the permit keyword for ACLs used as match criteria in
•
QoS policies. QoS policies do not match deny ACLs.
For protocol, enter the name or number of an IP protocol. Use the
•
question mark (?) to see a list of available protocols. To match any
Internet protocol (including ICMP, TCP, and UDP), enter ip.
The source is the number of the network or host sending the packet.
•
The source-wildcard applies wildcard bits to the source.
•
The destination is the network or host number receiving the packet.
•
The destination-wildcard applies wildcard bits to the destination.
•
You can specify source, destination, and wildcards as:
The 32-bit quantity in dotted-decimal format.
•
The keyword any for 0.0.0.0 255.255.255.255 (any host).
•
• The keyword host for a single host 0.0.0.0.
Other keywords are optional and have these meanings:
• precedence—Enter to match packets with a precedence level
specified as a number from 0 to 7 or by name: routine (0), priority
(1), immediate (2), flash (3), flash-override (4), critical (5),
internet (6), network (7).
tos—Enter to match by type of service level, specified by a number
•
from 0 to 15 or a name: normal (0), max-reliability (2),
max-throughput (4), min-delay (8).
dscp—Enter to match packets with the DSCP value specified by a
•
number from 0 to 63, or use the question mark (?) to see a list of
available values.
Define an extended IPv4 access list using a name, and enter access-list
configuration mode. The name can be a number from 100 to 199.
In access-list configuration mode, enter permit protocol {source
source-wildcard destination destination-wildcard} [precedence
precedence] [tos tos] [dscp dscp] as defined in Step 2.
Chapter 33 Configuring QoS
OL-9639-07