Creating A Numbered Extended Acl - Cisco Catalyst 3550 series Software Configuration Manual

Chapter 28 Configuring Network Security with ACLs

Creating a Numbered Extended ACL

Although standard ACLs use only source addresses for matching, you can use extended ACL source and
destination addresses for matching operations and optional protocol type information for finer
granularity of control. When you are creating ACEs in numbered extended access lists, remember that
after you create the ACL, any additions are placed at the end of the list. You cannot reorder the list or
selectively add or remove ACEs from a numbered list.
Some protocols also have specific parameters and keywords that apply to that protocol.
Extended ACLs support these IP protocols (protocol keywords are in parentheses in bold):
For more details on the specific keywords relative to each protocol, refer to Cisco IP and IP Routing
Command Reference for IOS Release 12.1.
Note The Catalyst 3550 switch does not support dynamic or reflexive access lists. It also does not support
filtering based on the type of service (ToS) minimize-monetary-cost bit.
Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP.
78-11194-09
Authentication Header Protocol (ahp), Enhanced Interior Gateway Routing Protocol (eigrp),
Encapsulation Security Payload (esp), generic routing encapsulation (gre), Internet Control
Message Protocol (icmp), Internet Group Management Protocol (igmp), Interior Gateway Routing
Protocol (igrp), any Interior Protocol (ip), IP in IP tunneling (ipinip), KA9Q NOS-compatible IP
over IP tunneling (nos), Open Shortest Path First routing (ospf), Payload Compression Protocol
(pcp), Protocol Independent Multicast (pim), Transmission Control Protocol (tcp), or User
Datagram Protocol (udp).
ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered.
Note
Catalyst 3550 Multilayer Switch Software Configuration Guide
Configuring IP ACLs
28-11