IP ACL Application Configuration Commands

IP ACLApplication Configuration Commands

I



IP ACL Application Configuration Commands

Table of Contents

1.1 IP ACL Application Configuration Commands...............................................................................1
1.1.1 ip access-group......................................................................................................................1
1.1.2 ipv6 access-group..................................................................................................................2

II



IP ACL Application Configuration Commands

Chapter 1 IP ACL Application Configuration Commands

1.1 IP ACL Application Configuration Commands
IP ACL Application Configuration Commands include:

 ip access-group

 ipv6 access-group

1.1.1 ip access-group

To control and access an interface, run ip access-group. To cancel the designated
access group, run no ipv6 access-group.

Use it on the interface

[no] ip access-group name

To apply the established IP access list to an interface or in the global mode or cancel a
IP access list which is already applied to an interface or in the global mode, run the
following command.

Use it in the global mode

[no] ip access-group name [vlan {word | add word | remove word}]

Parameters

Parameters Description

name Name of the IP access control list

Vlan THE ACCESS LIST IS APPLIED IN INGRESS.

Word VLAN RANGE TABLE

add ADD VLAN RANGE TABLE

remove DELETE VLAN RANGE TABLE

Command Mode

Global configuration mode or interface configuration mode

Usage Guidelines

Most rules in the ACL take effect through hardware; those that hardware does not
support give no errors but they have no actual effects; a few rules such as time-range
take effect through software.

1



IP ACL Application Configuration Commands

Note:

The IPv4 standard ACL supports the following rules:

any: means any source IP address.

source-addr source-mask : means matching up the source address.

reverse-mask source-addr source-mask: means to use the reverse source address for
match-up.

The IPv4 extended ACL supports the following rules:

any: means any IP address.

ip-protocol: means the IP protocol ID.

ip –IP protocol

reverse-mask: means the reverse configuration of varied protocols

eq/gt/lt/src-portrange/ dst-portrange: means TCP/UDP port ID match-up.

gre: GRE protocol ID match-up

icmp: ICMP protocol ID match-up

icmp: IGMP protocol ID match-up

ospf: OSPF routing protocol ID match-up

Though tcp/udp port ID can enable the source port ID match-up and the destination port
ID simultaneously, only the destination port ID match-up takes effect. Here is an
exception when the match-up is configured to eq. In such case, the source port ID
match-up and the destination port ID match-up takes effect simultaneously.

Example

The following example shows how to apply the ACL filter at the ingress direction of
interface g0/1.

Switch_config#inter g0/1
Switch_config_g0/1# ip access-group filter

1.1.2 ipv6 access-group

To designate an access group, run the ipv6 access-group. To cancel the designated
access group, run no ipv6 access-group.

Use it on the interface

[no] ipv6 access-group name

2



IP ACL Application Configuration Commands

Use it in the global mode

To apply or delete a created IPv6 ACL on a port or in global mode, run this command.

[no] ipv6 access-group name [vlan {word | add word | remove word}]

Parameters

Parameters Description
name Name of the ip access control list

vlan The access list is applied in ingress.

word vlan range table

add Add vlan range table

remove Delete vlan range table

Command Mode

Global configuration mode or interface configuration mode

Usage Guidelines

Most rules in the ACL take effect through hardware; those that hardware does not
support give no errors but they have no actual effects; a few rules such as time-range
take effect through software.

Note:

The IPv6 ACL supports the following rules:

any: means any IP address.

Ipv6-addr/ host Ipv6-addr： means IPv6 address match-up.

ip-protocol: means the IPv6 protocol ID.

eq/gt/lt/src-portrange/ dst-portrange: means TCP/UDP port ID match-up.

dscp/flow-label: means field match-up.

Though tcp/udp port ID can enable the source port ID match-up and the destination port
ID simultaneously, only the destination port ID match-up takes effect. Here is an
exception when the match-up is configured to eq. In such case, the source port ID
match-up and the destination port ID match-up takes effect simultaneously.

3



IP ACL Application Configuration Commands

Example

The following example shows how to apply the ACL filter at the ingress direction of
interface g0/1.

Switch_config#inter g0/1
Switch_config_g0/1# ipv6 access-group filter

4