Consolidated Platform Configuration Guide, Cisco Ios Release 15.2(4)E (Catalyst 2960-X Switches - Cisco Catalyst 2960 series Configuration Manual

How to Configure ACL Support for Filtering IP Options
• TCP flag filtering can be used only with named, extended ACLs.
Note
• The ACL TCP Flags Filtering feature is supported only for Cisco ACLs.
• Previously, the following command-line interface (CLI) format could be used to configure a TCP
permit tcp any any rst The following format that represents the same access control entry (ACE) can
now be used: permit tcp any any match-any +rst Both the CLI formats are accepted; however, if the
new keywords match-all or match-any are chosen, they must be followed by the new flags that are
prefixed with "+" or "-". It is advisable to use only the old format or the new format in a single ACL. You
cannot mix and match the old and new CLI formats.
If a device having ACEs with the new syntax format is reloaded with a previous version of the Cisco
Caution
software that does not support the ACL TCP Flags Filtering feature, the ACEs will not be applied, leading
to possible security loopholes.
SUMMARY STEPS
1. enable
2. configure terminal
3. ip access-list extended access-list-name
4. [sequence-number] permit tcp source source-wildcard [operator [port]] destination destination-wildcard
[operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos
tos] [log] [time-range time-range-name] [fragments]
5. [sequence-number] deny tcp source source-wildcard [operator [port]] destination destination-wildcard
[operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos
tos] [log] [time-range time-range-name] [fragments]
6. Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the
no sequence-numbercommand to delete an entry.
7. end
8. show ip access-lists access-list-name
DETAILED STEPS
Command or Action
Step 1 enable
Example:
Device> enable

Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)

1240
flag-checking mechanism:
Purpose
Enables privileged EXEC mode.
• Enter your password if prompted.