Filtering On Ip Precedence And Tos Values - Foundry Networks Switch and Router Installation And Configuration Manual

Using Access Control Lists (ACLs)
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates Syslog entries
for packets that are denied by this entry.
The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL
would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.
The following commands apply ACL 102 to the incoming and outgoing traffic on port 1/2 and to the incoming traffic
on port 4/3.
BigIron(config)# int eth 1/2
BigIron(config-if-1/2)# ip access-group 102 in
BigIron(config-if-1/2)# ip access-group 102 out
BigIron(config-if-1/2)# exit
BigIron(config)# int eth 4/3
BigIron(config-if-4/3)# ip access-group 102 in
BigIron(config)# write memory
Here is another example of an extended ACL.
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt telnet
neq 5
BigIron(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24 range 7 8
BigIron(config)# access-list 103 permit any any
The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network.
The second entry denies all FTP traffic from the 209.157.21.x network to the 209.157.22.x network.
The third entry denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if the TCP port
number of the traffic is less than the well-known TCP port number for Telnet (23), and if the TCP port is not equal
to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than 23 are allowed.
The fourth entry denies UDP packets from any source to the 209.157.22.x network, if the UDP port number from
the source network is 5 or 6 and the destination UDP port is 7 or 8.
The fifth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL
would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.
The following commands apply ACL 103 to the incoming and outgoing traffic on ports 2/1 and 2/2.
BigIron(config)# int eth 2/1
BigIron(config-if-2/1)# ip access-group 103 in
BigIron(config-if-2/1)# ip access-group 103 out
BigIron(config-if-2/1)# exit
BigIron(config)# int eth 2/2
BigIron(config-if-2/2)# ip access-group 103 in
BigIron(config-if-2/2)# ip access-group 103 out
BigIron(config)# write memory

Filtering on IP Precedence and TOS Values

To configure an extended IP ACL that matches based on IP precedence, enter commands such as the following:
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 precedence
internet
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24
precedence 6
BigIron(config)# access-list 103 permit any any
The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if the
traffic has the IP precedence option "internet" (equivalent to "6").
December 2000 13 - 11