Cisco 300 Series Cli Manual page 118

ACL Commands
OL-32830-01 Command Line Interface Reference Guide
options are +urg, +ack, +psh, +rst, +syn, +fin, -urg, -ack, -psh, -rst, -syn and
-fin. The flags are concatenated to a one string. For example: +fin-ack.
•
time-range-name—Name of the time range that applies to this permit
statement. (Range: 1–32)
•
disable-port—The Ethernet interface is disabled if the condition is matched.
•
log-input—Specifies sending an informational syslog message about the
packet that matches the entry. Because forwarding/dropping is done in
hardware and logging is done in software, if a large number of packets
match an ACE containing a log-input keyword, the software might not be
able to match the hardware processing rate, and not all packets will be
logged.
Default Configuration
No IPv4 access list is defined.
Command Mode
IP Access-list Configuration mode
User Guidelines
The number of TCP/UDP ranges that can be defined in ACLs is limited. If a range of
ports is used for a source port in ACE it is not counted again if it is also used for
source port in another ACE. If a range of ports is used for destination port in ACE it
is not counted again if it is also used for destination port in another ACE.
If a range of ports is used for source port, it is counted again if it is also used for
destination port.
If ace-priority is omitted, the system sets the rule's priority to the current highest
priority ACE (in the current ACL) + 20. The ACE-priority must be unique per ACL.If
the user types already existed priority, then the command is rejected.
Example
switchxxxxxx(config)#
ip access-list extended server
switchxxxxxx(config-ip-al)#
deny ip 176.212.0.0 00.255.255 any
4
118