Cisco Catalyst 2960-XR Security Configuration Manual page 146

Creating a Numbered Extended ACL
Command or Action
Step 4
access-list access-list-number {deny | permit}
udp source source-wildcard [operator port]
destination destination-wildcard [operator
port] [precedence precedence] [tos tos]
[fragments] [log [log-input] ] [time-range
time-range-name] [dscp dscp]
Example:
Switch(config)# access-list 101 permit
udp any any eq 100
Step 5 access-list access-list-number {deny | permit}
icmp source source-wildcard destination
destination-wildcard [icmp-type | [[icmp-type
icmp-code] | [icmp-message]] [precedence
precedence] [tos tos] [fragments] [log
[log-input] ] [time-range time-range-name]
[dscp dscp]
Example:
Switch(config)# access-list 101 permit
icmp any any 200
Step 6 access-list access-list-number {deny | permit}
igmp source source-wildcard destination
destination-wildcard [igmp-type] [precedence
precedence] [tos tos] [fragments] [log
[log-input] ] [time-range time-range-name]
[dscp dscp]
Example:
Switch(config)# access-list 101 permit
igmp any any 14
Step 7 end
Example:
Switch(config)# end
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
124
Purpose
• flag—Enter one of these flags to match by the specified TCP header
bits: ack (acknowledge), fin (finish), psh (push), rst (reset), syn
(synchronize), or urg (urgent).
(Optional) Defines an extended UDP access list and the access conditions.
The UDP parameters are the same as those described for TCP except that the
[operator [port]] port number or name must be a UDP port number or name,
and the flag and established keywords are not valid for UDP.
Defines an extended ICMP access list and the access conditions.
The ICMP parameters are the same as those described for most IP protocols
in an extended IPv4 ACL, with the addition of the ICMP message type and
code parameters. These optional keywords have these meanings:
• icmp-type—Enter to filter by ICMP message type, a number from 0
to 255.
• icmp-code—Enter to filter ICMP packets that are filtered by the ICMP
message code type, a number from 0 to 255.
• icmp-message—Enter to filter ICMP packets by the ICMP message
type name or the ICMP message type and code name.
(Optional) Defines an extended IGMP access list and the access conditions.
The IGMP parameters are the same as those described for most IP protocols
in an extended IPv4 ACL, with this optional parameter.
igmp-type—To match IGMP message type, enter a number from 0 to 15, or
enter the message name: dvmrp, host-query, host-report, pim, or trace.
Returns to privileged EXEC mode.
Configuring IPv4 ACLs
OL-29434-01