Contents - - Motorola WS5100 Series Cli Reference Manual

14-6 WS5100 Series Switch CLI Reference Guide
Usage Guidelines
Use this command to deny traffic between networks/hosts based on the protocol type
selected in the access list configuration. The following protocol types are supported:
• ip
• icmp
• tcp
• udp
The last ACE in the access list is an implicit deny statement.
Whenever the interface receives the packet, its content is checked against the ACEs in the
ACL. It is allowed/denied based on the ACL configuration.
• Filtering TCP/UDP allows the user to specify port numbers as filtering criteria
• Select the ICMP as the protocol to allow/deny ICMP packets. Selecting icmp provides
the option of filtering icmp packets based on icmp type and code
Example
The following example denies traffic between two subnets:
WS5100(config-ext-nacl)#deny ip 192.168.2.0/24 192.168.1.0/24
WS5100(config-ext-nacl)#permit ip any any
WS5100(config-ext-nacl)#
The following example denies TCP traffic with a source port range between 20 - 23 (from
the source subnet to destination subnet):
WS5100(config-ext-nacl)#deny tcp 192.168.1.0/24 192.168.2.0/
24 range 20 23
WS5100(config-ext-nacl)#permit ip any any
WS5100(config-ext-nacl)#
The following example denies UDP traffic with a source port range between 20 - 23 (from
the source subnet to destination subnet):
WS5100(config-ext-nacl)#deny udp 192.168.1.0/24 192.168.2.0/
24 range 20 23
WS5100(config-ext-nacl)#permit ip any any
WS5100(config-ext-nacl)#
NOTE: The log option is functional only for router ACL's. The log option
displays an informational logging message about the packet that
matches the entry sent to the console.