Defining Access-List Match Criteria; Defining Match Any Criteria - Cisco ACE-4710-K9 Administration Manual

Configuring Layer 3 and Layer 4 Class Maps

Defining Access-List Match Criteria

Defining Match Any Criteria

Cisco 4700 Series Application Control Engine Appliance Administration Guide
4-28
To configure the class map to filter Layer 3 and Layer 4 network traffic using a
predefined access control list (ACL), use the match access-list command in class
map configuration mode. When a packet matches an entry in an ACL, and if it is
a permit entry, the ACE allows the matching result. If it is a deny entry, the ACE
blocks the matching result. Refer to the Cisco 4700 Series Application Control
Engine Appliance Security Configuration Guide for details about creating ACLs
in the ACE.
The syntax of this command is:
[line_number] match access-list name
The arguments are:
line_number—(Optional) Line number to identify individual match
•
commands. Enter an integer from 2 to 255 as the line number. You can enter
no line_number to delete long match commands instead of entering the entire
line. The line numbers do not dictate a priority or sequence for the match
statements.
name—Previously created access list identifier. Enter an unquoted text string
•
with a maximum of 64 characters.
A single class map can have multiple match access-list commands. You may
combine multiple match access-list, match source-address, match
destination-address, and match port commands in a class map.
For example, to specify that the class map is to match on access control list
INBOUND, enter:
host1/Admin(config)# class-map match-any L4_FILTERTRAFFIC_CLASS
host1/Admin(config-cmap)# match access-list INBOUND
To clear the access control list match criteria from the class map, enter:
host1/Admin(config-cmap)# no match access-list INBOUND
To instruct the ACE to perform a match on any network traffic that passes through
the appliance, use the match any command in class map configuration mode. You
can include only one match any command within a class map and you cannot
combine the match any command with other types of match commands in a class
map because the ACE ignores the match criteria.
Chapter 4 Configuring Class Maps and Policy Maps
OL-11157-01