Copyright Page

Chapter 1. ACL Support for Filtering IP Options

Finding Feature Information

Prerequisites for ACL Support for Filtering IP Options

IP Options

Benefits of Filtering IP Options

Filtering Packets That Contain IP Options

Example: Filtering Packets That Contain IP Options

Additional References for ACL Support for Filtering IP Options

Feature Information for ACL Support for Filtering IP Options

Chapter 2. ACL Syslog Correlation

Finding Feature Information

Prerequisites for ACL Syslog Correlation

Information About ACL Syslog Correlation

ACL Syslog Correlation Tags

ACE Syslog Messages

How to Configure ACL Syslog Correlation

Enabling Hash Value Generation on a Device

Disabling Hash Value Generation on a Device

Configuring ACL Syslog Correlation Using a User-Defined Cookie

Configuring ACL Syslog Correlation Using a Hash Value

Changing the ACL Syslog Correlation Tag Value

Troubleshooting Tips

Configuration Examples for ACL Syslog Correlation

Example: Enabling Hash Value Generation on a Device

Example: Disabling Hash Value Generation on a Device

Example: Configuring ACL Syslog Correlation Using a User-Defined Cookie

Example: Configuring ACL Syslog Correlation using a Hash Value

Example: Changing the ACL Syslog Correlation Tag Value

Additional References for ACL Syslog Correlation

Feature Information for ACL Syslog Correlation

Chapter 3. Commented IP Access List Entries

Finding Feature Information

Benefits of IP Access Lists

Access List Remarks

Writing Remarks in a Named or Numbered Access List

Example: Writing Remarks in an IP Access List

Additional References for Commented IP Access List Entries

Feature Information for Commented IP Access List Entries

Chapter 4. Configuring an FQDN ACL

Finding Feature Information

Restrictions for Configuring FQDN ACL

Information About Configuring an FQDN ACL

Configuring an FQDN ACL

How to Configure FQDN ACL

Configuring an IP Access List

Configuring a Domain Name List

Mapping the FQDN ACL with a Domain Name

Monitoring an FQDN ACL

Configuration Examples for an FQDN ACL

Examples: FQDN ACL Configuration

Additional References for Configuring FQDN ACL

Feature Information for Configuring FQDN ACL

Chapter 5. Creating an IP Access List to Filter TCP Flags

Finding Feature Information

Prerequisites for Creating an IP Access List to Filter TCP Flags

Benefits of Filtering on TCP Flags

TCP Flags

Filtering Packets That Contain TCP Flags

Example: Filtering Packets That Contain TCP Flags

Additional References for Creating an IP Access List to Filter TCP Flags

Feature Information for Creating an IP Access List to Filter TCP Flags

Chapter 6. IPv6 ACL Extensions for Hop by Hop Filtering

Finding Feature Information

Information About IPv6 ACL Extensions for Hop by Hop Filtering

ACLs and Traffic Forwarding

How to Configure IPv6 ACL Extensions for Hop by Hop Filtering

Configuring IPv6 ACL Extensions for Hop by Hop Filtering

Configuration Example for IPv6 ACL Extensions for Hop by Hop Filtering

Example: IPv6 ACL Extensions for Hop by Hop Filtering

Additional References

Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

Chapter 7. IP Access List Entry Sequence Numbering

Finding Feature Information

Restrictions for IP Access List Entry Sequence Numbering

Information About IP Access List Entry Sequence Numbering

Purpose of IP Access Lists

How an IP Access List Works

IP Access List Process and Rules

Helpful Hints for Creating IP Access Lists

Source and Destination Addresses

Wildcard Mask and Implicit Wildcard Mask

Transport Layer Information

IP Access List Entry Sequence Numbering

Benefits

Sequence Numbering Behavior

How to Use Sequence Numbers in an IP Access List

Sequencing Access-List Entries and Revising the Access List

What to Do Next

Configuration Examples for IP Access List Entry Sequence Numbering

Example: Resequencing Entries in an Access List

Example: Adding Entries with Sequence Numbers

Example: Entry without Sequence Number

Additional References for IP Access List Entry Sequence Numbering

Feature Information for IP Access List Entry Sequence Numbering

Chapter 8. IP Named Access Control Lists

Finding Feature Information

Definition of an Access List

Named or Numbered Access Lists

Benefits of IP Access Lists

Access List Rules

Helpful Hints for Creating IP Access Lists

Where to Apply an Access List

Creating an IP Named Access List

Applying an Access List to an Interface

Example: Creating an IP Named Access Control List

Example: Applying the Access List to an Interface

Additional References for IP Named Access Control Lists

Feature Information for IP Named Access Control Lists

Chapter 9. IPv6 PACL Support

Finding Feature Information

Prerequisites for IPv6 PACL Support

IPv6 Port-Based Access Control List Support

Configuring PACL Mode and Applying IPv6 PACL on an Interface

Example: Configuring PACL Mode and Applying IPv6 PACL on an Interface

Additional References for IPv6 PACL Support

Feature Information for IPv6 PACL Support

Chapter 10. Named ACL Support for Noncontiguous Ports on an Access Control Entry

Finding Feature Information

Prerequisites for Named ACL Support for Noncontiguous Ports on an Access Control Entry

Benefits of Using the Named ACL Support for Noncontiguous Ports on an Access Control Entry Feature

Configuring an Access Control Entry with Noncontiguous Ports

Consolidating Access List Entries with Noncontiguous Ports into One Access List Entry

Example: Creating an Access List Entry with Noncontiguous Ports

Example: Consolidating Some Existing Access List Entries into One Access List Entry with Noncontiguous Ports

Additional References for Named ACL Support for Noncontiguous Ports on an Access Control Entry

Feature Information for Named ACL Support for Noncontiguous Ports on an Access Control Entry

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Chapter 1. ACL Support for Filtering IP Options

The ACL Support for Filtering IP Options feature describes how to use an IP access list to filter IP packets that contain IP options to prevent devices from becoming saturated with spurious packets.

- Finding Feature Information

- Prerequisites for ACL Support for Filtering IP Options

- Additional References for ACL Support for Filtering IP Options

- Feature Information for ACL Support for Filtering IP Options

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for ACL Support for Filtering IP Options

Before you configure the ACL Support for Filtering IP Options feature, you must understand the concepts of the IP access lists.

IP Options

IP uses four key mechanisms in providing its service: Type of Service, Time to Live, Options, and Header Checksum.

The Options, commonly referred to as IP Options, provide for control functions that are required in some situations but unnecessary for the most common communications. IP Options include provisions for time stamps, security, and special routing.

IP Options may or may not appear in datagrams. They must be implemented by all IP modules (host and gateways). What is optional is their transmission in any particular datagram, not their implementation. In some environments the security option may be required in all datagrams.

The option field is variable in length. There may be zero or more options. IP Options can have one of two formats:

- Format 1: A single octet of option-type.

- Format 2: An option-type octet, an option-length octet, and the actual option-data octets.

The option-length octet counts the option-type octet, the option-length octet, and the option-data octets.

The option-type octet is viewed as having three fields: a 1-bit copied flag, a 2-bit option class, and a 5-bit option number. These fields form an 8-bit value for the option type field. IP Options are commonly referred to by their 8-bit value.

For a complete list and description of IP Options, refer to RFC 791, Internet Protocol at the following URL: http://www.faqs.org/rfcs/rfc791.html

Benefits of Filtering IP Options

- Filtering of packets that contain IP Options from the network relieves downstream devices and hosts of the load from options packets.

- This feature also minimizes load to the Route Processor (RP) for packets with IP Options that require RP processing on distributed systems. Previously, the packets were always routed to or processed by the RP CPU. Filtering the packets prevents them from impacting the RP.

Filtering Packets That Contain IP Options

Complete these steps to configure an access list to filter packets that contain IP options and to verify that the access list has been configured correctly.

Note

- The ACL Support for Filtering IP Options feature can be used only with named, extended ACLs.

- Resource Reservation Protocol (RSVP) Multiprotocol Label Switching Traffic Engineering (MPLS TE), Internet Group Management Protocol Version 2 (IGMPV2), and other protocols that use IP options packets may not function in drop or ignore mode if this feature is configured.

- On most Cisco devices, a packet with IP options is not switched in hardware, but requires control plane software processing (primarily because there is a need to process the options and rewrite the IP header), so all IP packets with IP options will be filtered and switched in software.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] deny protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] permit protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list extended access-list-name

Example:

Device(config)# ip access-list extended mylist1

Specifies the IP access list by name and enters named access list configuration mode.

Step 4

[sequence-number] deny protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# deny ip any any option traceroute

(Optional) Specifies a deny statement in named IP access list mode.

- This access list happens to use a denystatement first, but a permit statement could appear first, depending on the order of statements you need.

- Use the option keyword and option-value argument to filter packets that contain a particular IP Option.

- In this example, any packet that contains the traceroute IP option will be filtered out.

- Use the no sequence-number form of this command to delete an entry.

Step 5

[sequence-number] permit protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# permit ip any any option security

Specifies a permit statement in named IP access list mode.

- In this example, any packet (not already filtered) that contains the security IP option will be permitted.

- Use the no sequence-number form of this command to delete an entry.

Step 6

Repeat Step 4 or Step 5 as necessary.

Allows you to revise the access list.

Step 7

end

Example:

Device(config-ext-nacl)# end

(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.

Step 8

show ip access-lists access-list-name

Example:

Device# show ip access-lists mylist1

(Optional) Displays the contents of the IP access list.

Example: Filtering Packets That Contain IP Options

The following example shows an extended access list named mylist2 that contains access list entries (ACEs) that are configured to permit TCP packets only if they contain the IP Options that are specified in the ACEs:

ip access-list extended mylist2
10 permit ip any any option eool
20 permit ip any any option record-route
30 permit ip any any option zsu
40 permit ip any any option mtup

The show access-list command has been entered to show how many packets were matched and therefore permitted:

Device# show ip access-list mylist2
Extended IP access list test
10 permit ip any any option eool (1 match)
20 permit ip any any option record-route (1 match)
30 permit ip any any option zsu (1 match)
40 permit ip any any option mtup (1 match)

Additional References for ACL Support for Filtering IP Options

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Overview information about access lists

"IP Access List Overview"

Standards and RFCs

Standards/RFCs

Title

RFC 791

Internet Protocol

RFC 793

Transmission Control Protocol

RFC 1393

Traceroute Using an IP Option

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for ACL Support for Filtering IP Options

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for ACL Support for Filtering IP Options

Feature Name

Releases

Feature Information

ACL Support for Filtering IP Options

Cisco IOS 15.2(2)E

The ACL Support for Filtering IP Options feature describes how to use an IP access list to filter IP packets that contain IP options to prevent devices from becoming saturated with spurious packets.

Chapter 2. ACL Syslog Correlation

The Access Control List (ACL) Syslog Correlation feature appends a tag (either a user-defined cookie or a device-generated MD5 hash value) to access control entry (ACE) syslog entries. This tag uniquely identifies the ACE , within the ACL, that generated the syslog entry.

- Finding Feature Information

- Prerequisites for ACL Syslog Correlation

- Information About ACL Syslog Correlation

- How to Configure ACL Syslog Correlation

- Configuration Examples for ACL Syslog Correlation

- Additional References for ACL Syslog Correlation

- Feature Information for ACL Syslog Correlation

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for ACL Syslog Correlation

Before you configure the ACL Syslog Correlation feature, you must understand the concepts in the "IP Access List Overview" module.

The ACL Syslog Correlation feature appends a user-defined cookie or a device-generated hash value to ACE messages in the syslog. These values are only appended to ACE messages when the log option is enabled for the ACE.

Information About ACL Syslog Correlation

- ACL Syslog Correlation Tags

- ACE Syslog Messages

ACL Syslog Correlation Tags

The ACL Syslog Correlation feature appends a tag (either a user-defined cookie or a device-generated MD5 hash value) to access control entry (ACE) syslog entries. This tag uniquely identifies an ACE that generated the syslog entry.

Network management software can use the tag to identify which ACE generated a specific syslog event. For example, network administrators can select an ACE rule in the network management application and can then view the corresponding syslog events for that ACE rule.

To append a tag to the syslog message, the ACE that generates the syslog event must have the log option enabled. The system appends only one type of tag (either a user-defined cookie or a device-generated MD5 hash value) to each message.

To specify a user-defined cookie tag, the user must enter the cookie value when configuring the ACE log option. The cookie must be in alpha-numeric form, it cannot be greater than 64 characters, and it cannot start with hex-decimal notation (such as 0x).

To specify a device-generated MD5 hash value tag, the hash-generation mechanism must be enabled on the device and the user must not enter a cookie value while configuring the ACE log option.

ACE Syslog Messages

When a packet is matched against an access control entry (ACE) in an ACL, the system checks whether the log option is enabled for that event. If the log option is enabled and the ACL Syslog Correlation feature is configured on the device, the system attaches the tag to the syslog message. The tag is displayed at the end of the syslog message, in addition to the standard information.

The following is a sample syslog message showing a user-defined cookie tag:

Jun 5 12:55:44.359: %SEC-6-IPACCESSLOGP: list logacl permitted tcp 192.168.16.1(38402) -> 192.168.16.2(23), 1 packet [User_permiited_ACE]

The following is a sample syslog message showing a hash value tag:

Jun 5 12:55:44.359: %SEC-6-IPACCESSLOGP: list logacl permitted tcp 192.168.16.1(38402) -> 192.168.16.2(23), 1 packet [0x723E6E12]

How to Configure ACL Syslog Correlation

- Enabling Hash Value Generation on a Device

- Disabling Hash Value Generation on a Device

- Configuring ACL Syslog Correlation Using a User-Defined Cookie

- Configuring ACL Syslog Correlation Using a Hash Value

- Changing the ACL Syslog Correlation Tag Value

Enabling Hash Value Generation on a Device

Perform this task to configure the device to generate an MD5 hash value for each log-enabled access control entry (ACE) in the system that is not configured with a user-defined cookie.

When the hash value generation setting is enabled, the system checks all existing ACEs and generates a hash value for each ACE that requires one. When the hash value generation setting is disabled, all previously generated hash values are removed from the system.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list logging hash-generation

4.    end

5.    Do one of the following:

- show ip access-list access-list-number

- show ip access-list access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list logging hash-generation

Example:

Device(config)# ip access-list logging hash-generation

Enables hash value generation on the device.

- If an ACE exists that is log enabled, and requires a hash value, the device automatically generates the value and displays the value on the console.

Step 4

end

Example:

Device(config)# end

(Optional) Exits global configuration mode and returns to privileged EXEC mode.

Step 5

Do one of the following:

- show ip access-list access-list-number

- show ip access-list access-list-name

Example:

Device# show ip access-list 101

Example:

Device# show ip access-list acl

(Optional) Displays the contents of the numbered or named IP access list.

- Review the output to confirm that the access list for a log-enabled ACE includes the generated hash value.

Disabling Hash Value Generation on a Device

Perform this task to disable hash value generation on the device. When the hash value generation setting is disabled, all previously generated hash values are removed from the system.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    no ip access-list logging hash-generation

4.    end

5.    Do one of the following:

- show ip access-list access-list-number

- show ip access-list access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

no ip access-list logging hash-generation

Example:

Device(config)# no ip access-list logging hash-generation

Disables hash value generation on the device.

- The system removes any previously created hash values from the system.

Step 4

end

Example:

Device(config)# end

(Optional) Exits global configuration mode and returns to privileged EXEC mode.

Step 5

Do one of the following:

- show ip access-list access-list-number

- show ip access-list access-list-name

Example:

Device# show ip access-list 101

Example:

Device# show ip access-list acl

(Optional) Displays the contents of the IP access list.

- Review the output to confirm that the access list for a log-enabled ACE does not have a generated hash value.

Configuring ACL Syslog Correlation Using a User-Defined Cookie

Perform this task to configure the ACL Syslog Correlation feature on a device for a specific access list, using a user-defined cookie as the syslog message tag.

The example in this section shows how to configure the ACL Syslog Correlation feature using a user-defined cookie for a numbered access list. However, you can configure the ACL Syslog Correlation feature using a user-defined cookie for both numbered and named access lists, and for both standard and extended access lists.

Note

The following restrictions apply when choosing the user-defined cookie value:

- The maximum number of characters is 64.

- The cookie cannot start with hexadecimal notation (such as 0x).

- The cookie cannot be the same as, or a subset of, the following keywords: reflect, fragment, time-range. For example, reflect and ref are not valid values. However, the cookie can start with the keywords. For example, reflectedACE and fragment_33 are valid values

- The cookie must contains only alphanumeric characters.

>

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    access-list access-list-number permit protocol source destination log word

4.    end

5.    show ip access-list access-list-number

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

access-list access-list-number permit protocol source destination log word

Example:

Device(config)# access-list 101 permit tcp host 10.1.1.1 host 10.1.1.2 log UserDefinedValue

Defines an extended IP access list and a user-defined cookie value.

- Enter the cookie value as the wordargument.

Step 4

end

Example:

Device(config)# end

(Optional) Exits global configuration mode and returns to privileged EXEC mode.

Step 5

show ip access-list access-list-number

Example:

Device# show ip access-list 101

(Optional) Displays the contents of the IP access list.

- Review the output to confirm that the access list includes the user-defined cookie value.

Examples

The following is sample output from the show ip access-list command for an access list with a user-defined cookie value.

Device# show ip access-list
101
Extended IP access list 101
30 permit tcp host 10.1.1.1 host 10.1.1.2 log (tag = UserDefinedValue)

Configuring ACL Syslog Correlation Using a Hash Value

Perform this task to configure the ACL Syslog Correlation feature on a device for a specific access list, using a device-generated hash value as the syslog message tag.

The steps in this section shows how to configure the ACL Syslog Correlation feature using a device-generated hash value for a numbered access list. However, you can configure the ACL Syslog Correlation feature using a device-generated hash value for both numbered and named access lists, and for both standard and extended access lists.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list logging hash-generation

4.    access-list access-list-number permit protocol source destination log

5.    end

6.    show ip access-list access-list-number

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list logging hash-generation

Example:

Device(config)# ip access-list logging hash-generation

Enables hash value generation on the device.

- If an ACE exists that is log enabled, and requires a hash value, the device automatically generates the value and displays the value on the console.

Step 4

access-list access-list-number permit protocol source destination log

Example:

Device(config)# access-list 102 permit tcp host 10.1.1.1 host 10.1.1.2 log

Defines an extended IP access list.

- Enable the log option for the access list, but do not specify a cookie value.

- The device automatically generates a hash value for the newly defined access list.

Step 5

end

Example:

Device(config)# end

(Optional) Exits global configuration mode and returns to privileged EXEC mode.

Step 6

show ip access-list access-list-number

Example:

Device# show ip access-list 102

(Optional) Displays the contents of the IP access list.

- Review the output to confirm that the access list includes the router-generated hash value.

Examples

The following is sample output from the show ip access-list command for an access list with a device-generated hash value.

Device# show ip access-list
102
Extended IP access list 102
10 permit tcp host 10.1.1.1 host 10.1.1.2 log (hash = 0x7F9CF6B9)

Changing the ACL Syslog Correlation Tag Value

Perform this task to change the value of the user-defined cookie or replace a device-generated hash value with a user-defined cookie.

The steps in this section shows how to change the ACL Syslog Correlation tag value on a numbered access list. However, you can change the ACL Syslog Correlation tag value for both numbered and named access lists, and for both standard and extended access lists.

SUMMARY STEPS

1.    enable

2.    show access-list

3.    configure terminal

4.    access-list access-list-number permit protocol source destination log word

5.    end

6.    show ip access-list access-list-number

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

show access-list

Example:

Device(config)# show access-list

(Optional) Displays the contents of the access list.

Step 3

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 4

access-list access-list-number permit protocol source destination log word

Example:

Device(config)# access-list 101 permit tcp host 10.1.1.1 host 10.1.1.2 log NewUDV

Example:

OR

Example:

Example:

Device(config)# access-list 101 permit tcp any any log replacehash

Modifies the cookie or changes the hash value to a cookie.

- You must enter the entire access list configuration command, replacing the previous tag value with the new tag value.

Step 5

end

Example:

Device(config)# end

(Optional) Exits global configuration mode and returns to privileged EXEC mode.

Step 6

show ip access-list access-list-number

Example:

Device# show ip access-list 101

(Optional) Displays the contents of the IP access list.

- Review the output to confirm the changes.

- Troubleshooting Tips

Troubleshooting Tips

Use the debug ip access-list hash-generation command to display access list debug information. The following is an example of the debug command output:

Device# debug ip access-list hash-generation
Syslog hash code generation debugging is on
Device# show debug
IP ACL:
Syslog hash code generation debugging is on
Device# no debug ip access-list hash-generation

Syslog hash code generation debugging is off
Device# show debug
Device#

Configuration Examples for ACL Syslog Correlation

- Example: Enabling Hash Value Generation on a Device

- Example: Disabling Hash Value Generation on a Device

- Example: Configuring ACL Syslog Correlation Using a User-Defined Cookie

- Example: Configuring ACL Syslog Correlation using a Hash Value

- Example: Changing the ACL Syslog Correlation Tag Value

Example: Enabling Hash Value Generation on a Device

The following is sample output from the show ip access-list command when hash generation is enabled for the specified access-list.

Device# show ip access-list 101
Extended IP access list 101
10 permit tcp any any log (hash = 0x75F078B9)
Device# show ip access-list acl
Extended IP access list acl
10 permit tcp any any log (hash = 0x3027EB26)

Example: Disabling Hash Value Generation on a Device

The following is sample output from the show ip access-list command when hash generation is disabled and no cookie value has been specified.

Device# show ip access-list
101
Extended IP access list 101
10 permit tcp any any log
Device# show ip access-list
acl
Extended IP access list acl
10 permit tcp any any log

Example: Configuring ACL Syslog Correlation Using a User-Defined Cookie

The following example shows how to configure the ACL Syslog Correlation feature on a device using a user-defined cookie.

Device#
Device# debug ip access-list hash-generation
Syslog MD5 hash code generation debugging is on
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# access-list 33 permit 10.10.10.6 log cook_33_std
Device(config)# do show ip access 33
Standard IP access list 33
10 permit 10.10.10.6 log (tag = cook_33_std)
Device(config)# end

Example: Configuring ACL Syslog Correlation using a Hash Value

The following examples shows how to configure the ACL Syslog Correlation feature on a device using a device-generated hash value.

Device# debug ip access-list hash-generation
Syslog MD5 hash code generation debugging is on
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# access-list 33 permit 10.10.10.7 log
Device(config)#
*Nov 7 13:51:23.615: %IPACL-HASHGEN: Hash Input: 33 standard permit 10.10.10.7
Hash Output: 0xCE87F535
Device(config)#
do show ip access 33

Standard IP access list 33
10 permit 10.10.10.6 log (tag = cook_33_std)
20 permit 10.10.10.7 log (hash = 0xCE87F535)

Example: Changing the ACL Syslog Correlation Tag Value

The following example shows how to replace an existing access list user-defined cookie with a new cookie value, and how to replace a device-generated hash value with a user-defined cookie value.

Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# do show ip access-list 101
Extended IP access list 101
10 permit tcp host 10.1.1.1 host 10.1.1.2 log (tag = MyCookie)
20 permit tcp any any log (hash = 0x75F078B9)
Device(config)# access-list 101 permit tcp host 10.1.1.1 host 10.1.1.2 log NewUDV
Device(config)# do show access-list
Extended IP access list 101
10 permit tcp host 10.1.1.1 host 10.1.1.2 log (tag = NewUDV)
20 permit tcp any any log (hash = 0x75F078B9)
Device(config)# access-list 101 permit tcp any any log replacehash
Device(config)# do show access-list
Extended IP access list 101
10 permit tcp host 10.1.1.1 host 10.1.1.2 log (tag = NewUDV)
20 permit tcp any any log (tag = replacehash)

Additional References for ACL Syslog Correlation

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

ACL commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Configuring and Creating ACLs

"Creating an IP Access List and Applying it to an Interface"

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for ACL Syslog Correlation

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for ACL Syslog Correlation

Feature Name

Releases

Feature Information

ACL Syslog Correlation

Cisco IOS 15.2(2)E

The ACL Syslog Correlation feature appends a tag (either a user-defined cookie or a device-generated MD5 hash value) to ACE syslog entries. This tag uniquely identifies the ACE , within the ACL, that generated the syslog entry.

The following commands were introduced or modified: ip access-list logging hash-generation, debug ip access-list hash-generation, access-list (IP extended), access-list (IP standard), permit, permit (Catalyst 6500 series switches), permit (IP).

Chapter 3. Commented IP Access List Entries

The Commented IP Access List Entries feature allows you to include comments or remarks about deny or permit conditions in any IP access list. These remarks make access lists easier for network administrators to understand. Each remark is limited to 100 characters in length.

This module provides information about the Commented IP Access List Entries feature.

- Finding Feature Information

- Additional References for Commented IP Access List Entries

- Feature Information for Commented IP Access List Entries

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Benefits of IP Access Lists

Access control lists (ACLs) perform packet filtering to control the flow of packets through a network. Packet filtering can restrict the access of users and devices to a network, providing a measure of security. Access lists can save network resources by reducing traffic. The benefits of using access lists are as follows:

- Authenticate incoming rsh and rcp requests—Access lists can simplify the identification of local users, remote hosts, and remote users in an authentication database that is configured to control access to a device. The authentication database enables Cisco software to receive incoming remote shell (rsh) and remote copy (rcp) protocol requests.

- Block unwanted traffic or users—Access lists can filter incoming or outgoing packets on an interface, thereby controlling access to a network based on source addresses, destination addresses, or user authentication. You can also use access lists to determine the types of traffic that are forwarded or blocked at device interfaces. For example, you can use access lists to permit e-mail traffic to be routed through a network and to block all Telnet traffic from entering the network.

- Control access to vty—Access lists on an inbound vty (Telnet) can control who can access the lines to a device. Access lists on an outbound vty can control the destinations that the lines from a device can reach.

- Identify or classify traffic for QoS features—Access lists provide congestion avoidance by setting the IP precedence for Weighted Random Early Detection (WRED) and committed access rate (CAR). Access lists also provide congestion management for class-based weighted fair queueing (CBWFQ), priority queueing, and custom queueing.

- Limit debug command output—Access lists can limit debug output based on an IP address or a protocol.

- Provide bandwidth control—Access lists on a slow link can prevent excess traffic on a network.

- Provide NAT control—Access lists can control which addresses are translated by Network Address Translation (NAT).

- Reduce the chance of DoS attacks—Access lists reduce the chance of denial-of-service (DoS) attacks. Specify IP source addresses to control traffic from hosts, networks, or users from accessing your network. Configure the TCP Intercept feature to can prevent servers from being flooded with requests for connection.

- Restrict the content of routing updates—Access lists can control routing updates that are sent, received, or redistributed in networks.

- Trigger dial-on-demand calls—Access lists can enforce dial and disconnect criteria.

Access List Remarks

You can include comments or remarks about entries in any IP access list. An access list remark is an optional remark before or after an access list entry that describes the entry so that you do not have to interpret the purpose of the entry. Each remark is limited to 100 characters in length.

The remark can go before or after a permit or deny statement. Be consistent about where you add remarks. Users may be confused if some remarks precede the associated permit or deny statements and some remarks follow the associated statements.

The following is an example of a remark that describes function of the subsequent deny statement:

ip access-list extended telnetting
remark Do not allow host1 subnet to telnet out
deny tcp host 172.16.2.88 any eq telnet

Writing Remarks in a Named or Numbered Access List

You can use a named or numbered access list configuration. You must apply the access list to an interface or terminal line after the access list is created for the configuration to work.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list {standard | extended} {name | number}

4.    remark remark

5.    deny protocol host host-address any eq port

6.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list {standard | extended} {name | number}

Example:

Device(config)# ip access-list extended telnetting

Identifies the access list by a name or number and enters extended named access list configuration mode.

Step 4

remark remark

Example:

Device(config-ext-nacl)# remark Do not allow host1 subnet to telnet out

Adds a remark for an entry in a named IP access list.

- The remark indicates the purpose of the permit or deny statement.

Step 5

deny protocol host host-address any eq port

Example:

Device(config-ext-nacl)# deny tcp host 172.16.2.88 any eq telnet

Sets conditions in a named IP access list that denies packets.

Step 6

end

Example:

Device(config-ext-nacl)# end

Exits extended named access list configuration mode and enters privileged EXEC mode.

Example: Writing Remarks in an IP Access List

Device# configure terminal
Device(config)# ip access-list extended telnetting
Device(config-ext-nacl)# remark Do not allow host1 subnet to telnet out
Device(config-ext-nacl)# deny tcp host 172.16.2.88 any eq telnet
Device(config-ext-nacl)# end

Additional References for Commented IP Access List Entries

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Commented IP Access List Entries

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Commented IP Access List Entries

Feature Name

Releases

Feature Information

Commented IP Access List Entries

Cisco IOS 15.2(2)E

The Commented IP Access List Entries feature allows you to include comments or remarks about deny or permit conditions in any IP access list. These remarks make access lists easier for network administrators to understand. Each remark is limited to 100 characters in length.

In Cisco IOS Release 15.2(2)E, support was added for the Cisco Catalyst 3850 Series Switches.

The following command was introduced or modified: remark.

Chapter 4. Configuring an FQDN ACL

This document describes how to configure an access control lists (ACL) using a fully qualified domain name (FQDN). The Configuring an FQDN ACL feature allows you to configure and apply an ACL to a wireless session based on the domain name system (DNS). The domain names are resolved to IP addresses, the IP addresses are given to the client as part of the DNS response, and the FQDN is then mapped to an ACL based on the IP address.

- Finding Feature Information

- Restrictions for Configuring FQDN ACL

- Information About Configuring an FQDN ACL

- How to Configure FQDN ACL

- Monitoring an FQDN ACL

- Configuration Examples for an FQDN ACL

- Additional References for Configuring FQDN ACL

- Feature Information for Configuring FQDN ACL

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for Configuring FQDN ACL

The Configuring FQDN ACL feature is supported only on IPv4 wireless sessions.

Information About Configuring an FQDN ACL

- Configuring an FQDN ACL

Configuring an FQDN ACL

When access control lists (ACLs) are configured using a fully qualified domain name (FQDN), ACLs can be applied based on the destination domain name. The destination domain name is then resolved to an IP address, which is provided to the client as a part of the DNS response.

Guest users can log in using web authentication with a parameter map that consists of an FQDN ACL name.

Before you configure an FQDN ACL, complete the following tasks:

- Configure an IP access list.

- Configure an IP domain name list.

- Map an FQDN ACL with a domain name.

You can apply an access list to a specific domain by configuring the RADIUS server to send the fqdn-acl-name AAA attribute to the controller. The operating system checks for the passthrough domain list and its mapping, and permits the FQDN. The FQDN ACL allows clients to access only configured domains without authentication.

Note

By default, an IP access list name is configured with the same name as the pass-through domain name. To override the default name, you can use the access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name command in global configuration mode.

How to Configure FQDN ACL

- Configuring an IP Access List

- Configuring a Domain Name List

- Mapping the FQDN ACL with a Domain Name

Configuring an IP Access List

SUMMARY STEPS

1.    configure terminal

2.    ip access-list extended name

3.    permit ip any any

4.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 2

ip access-list extended name

Example:

(config)# ip access-list extended ABC

Creates the IP access list.

Step 3

permit ip any any

Example:

(config-ext-nacl)# permit ip any any

Specifies the domains to be allowed for the wireless client. The domains are specified in the domain name list.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring a Domain Name List

You can configure a domain name list that contains a list of domain names that are allowed for DNS snooping by the access point. The DNS domain list name string must be identical to the extended access list name.

SUMMARY STEPS

1.    configure terminal

2.    passthrou-domain-list name

3.    match word

4.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 2

passthrou-domain-list name

Example:

(config)# passthrou-domain-list abc
(config-fqdn-acl-domains)#

Configures a passthrough domain name list.

Step 3

match word

Example:

(config-fqdn-acl-domains)# match play.google.com
(config-fqdn-acl-domains)# match www.yahoo.com

Configures a passthrough domain list. Adds a list of websites that the client is allowed to query for access without first being required to be authenticated through the RADIUS server.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Mapping the FQDN ACL with a Domain Name

SUMMARY STEPS

1.    configure terminal

2.    access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name

3.    parameter-map type webauth domain-list-name and login-auth-bypass fqdn-acl-name acl-name domain-name domain-name

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 2

access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name

Example:

(config)# access-session passthrou-access-group abc passthrou-domain-list abc

Maps the FQDN ACL AAA attribute name with the domain name list. Use this command when configuring central web authentication.

Step 3

parameter-map type webauth domain-list-name and login-auth-bypass fqdn-acl-name acl-name domain-name domain-name

Example:

(config)# parameter-map type webauth abc
(config-params-parameter-map)# login-auth-bypass fqdn-acl-name abc domain-name abc

Maps an FQDN ACL name with the domain name list. Use the command when configuring local authentication on the controller.

The RADIUS server can be configured to return an FQDN ACL name as part of the authenticated user profile. The controller dynamically applies the FQDN ACL to the user if the FQDN ACL is defined on the controller.

Monitoring an FQDN ACL

The following commands can be used to monitor FQDN ACLs.

Command

Purpose

show access-session interface interface-name details

Displays the FQDN ACL information configured on the interface.

show access-session fqdn fqdn-maps

Displays the FQDN ACL mapped to the domain name list.

show access-session fqdn list-domain domain-name

Displays the domain names.

show access-session fqdn passthru-domain-list

Displays the domains that are configured.

Configuration Examples for an FQDN ACL

- Examples: FQDN ACL Configuration

Examples: FQDN ACL Configuration

This example shows how to create IP access list:

# config terminal
(config)# ip access-list extended abc
(config-ext-nacl)# permit ip any any
(config-ext-nacl)# end
# show ip access-list abc

This example shows how to configure domain name list:

# config terminal
(config)# passthrou-domain-list abc
(config-fqdn-acl-domains)# match play.google.com
(config-fqdn-acl-domains)# end
# show access-session fqdn fqdn-maps

This example shows how to map FQDN ACL with domain name using central web authentication:

# config terminal
(config)# access-session passthrou-access-group abc passthrou-domain-list abc
(config)# end
# show access-session interface vlan 20

This example shows how to map FQDN ACL with domain name using local authentication:

# config terminal
(config)# parameter-map type webauth abc
(config-params-parameter-map)# login-auth-bypass fqdn-acl-name abc domain-name abc
(config-params-parameter-map)# end
# show access-session fqdn fqdn-maps

Additional References for Configuring FQDN ACL

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

ACL configuration guide

Security Configuration Guide: Access Control Lists

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Configuring FQDN ACL

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Configuring FQDN ACL

Feature Name

Releases

Feature Information

Configuring an FQDN ACL

Cisco IOS 15.2(2)E

The Configuring an FQDN ACL feature allows you to configure and apply an access control lists (ACL) to a wireless session based on the domain name system (DNS). The domain names are resolved to IP addresses, where the IP addresses are given to the client as part of the DNS response; the FQDN is then mapped to an ACL based on the IP address.

In Cisco IOS RElease 15.2(2)E or Cisco IOS XE 3.6E, this feature is supported on the following platforms:

- Catalyst 4500E Supervisor Engine 7-E

- Catalyst 4500E Supervisor Engine 7L-E

- Catalyst 4500E Supervisor Engine 8-E

- Catalyst 4500-X Series Switches

- Catalyst 3850 Series Switches

- Catalyst 3650 Series Switches

- Cisco 5760 Wireless Controller

- Cisco Industrial Ethernet 3000 Series Switches

- Cisco Industrial Ethernet 2000 Series Switches

- Cisco Catalyst 2960-S Series Switches (Stout)

- Cisco Catalyst 2960-X Series Switches (Porter)

- Cisco Catalyst 2960-X Series Switches (Kingfisher)

The following commands were introduced or modified: access session passthrou access group, login-auth-bypass, parameter-map type webauth global, pass throu domain list name, show access-session fqdn.

Chapter 5. Creating an IP Access List to Filter TCP Flags

This module documents the ACL TCP Flags Filtering feature and describes how to use an IP access list to filter IP packets that contain TCP flags. The ACL TCP Flags Filtering feature allows you to select any combination of flags on which to filter. The ability to match on a flag set and on a flag not set gives you a greater degree of control for filtering on TCP flags, thus enhancing security

The ACL TCP Flags Filtering feature provides a flexible mechanism for filtering on TCP flags. Before this feature, an incoming packet was matched if any TCP flag in the packet matched a flag specified in the access control entry (ACE). This behavior allowed for a security loophole, because packets with all flags set could get past the access control list (ACL).

- Finding Feature Information

- Prerequisites for Creating an IP Access List to Filter TCP Flags

- Additional References for Creating an IP Access List to Filter TCP Flags

- Feature Information for Creating an IP Access List to Filter TCP Flags

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for Creating an IP Access List to Filter TCP Flags

Before you perform any of the tasks in this module, you should be familiar with the information in the following modules:

- “IP Access List Overview”

- “Creating an IP Access List and Applying It to an Interface”

Benefits of Filtering on TCP Flags

The ACL TCP Flags Filtering feature provides a flexible mechanism for filtering on TCP flags. Previously, an incoming packet was matched as long as any TCP flag in the packet matched a flag specified in the access control entry (ACE). This behavior allows for a security loophole, because packets with all flags set could get past the access control list (ACL). The ACL TCP Flags Filtering feature allows you to select any combination of flags on which to filter. The ability to match on a flag set and on a flag not set gives you a greater degree of control for filtering on TCP flags, thus enhancing security.

Because TCP packets can be sent as false synchronization packets that can be accepted by a listening port, it is recommended that administrators of firewall devices set up some filtering rules to drop false TCP packets.

The ACEs that make up an access list can be configured to detect and drop unauthorized TCP packets by allowing only the packets that have a very specific group of TCP flags set or not set. The ACL TCP Flags Filtering feature provides a greater degree of packet-filtering control in the following ways:

- You can select any desired combination of TCP flags on which to filter TCP packets.

- You can configure ACEs to allow matching on a flag that is set, as well as on a flag that is not set.

TCP Flags

The table below lists the TCP flags, which are further described in RFC 793, Transmission Control Protocol.

TCP Flags

TCP Flag

Purpose

ACK

Acknowledge flag—Indicates that the acknowledgment field of a segment specifies the next sequence number the sender of this segment is expecting to receive.

FIN

Finish flag—Used to clear connections.

PSH

Push flag—Indicates the data in the call should be immediately pushed through to the receiving user.

RST

Reset flag—Indicates that the receiver should delete the connection without further interaction.

SYN

Synchronize flag—Used to establish connections.

URG

Urgent flag—Indicates that the urgent field is meaningful and must be added to the segment sequence number.

Filtering Packets That Contain TCP Flags

This task configures an access list to filter packets that contain TCP flags and verifies that the access list has been configured correctly.

Note

- TCP flag filtering can be used only with named, extended ACLs.

- The ACL TCP Flags Filtering feature is supported only for Cisco ACLs.

- Previously, the following command-line interface (CLI) format could be used to configure a TCP flag-checking mechanism:

permit tcp any any rst The following format that represents the same ACE can now be used: permit tcp any any match-any +rst Both the CLI formats are accepted; however, if the new keywords match-all or match-any are chosen, they must be followed by the new flags that are prefixed with “+” or “-”. It is advisable to use only the old format or the new format in a single ACL. You cannot mix and match the old and new CLI formats.

Caution

If a device having ACEs with the new syntax format is reloaded with a previous version of the Cisco software that does not support the ACL TCP Flags Filtering feature, the ACEs will not be applied, leading to possible security loopholes.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] deny tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-numbercommand to delete an entry.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list extended access-list-name

Example:

Device(config)# ip access-list extended kmd1

Specifies the IP access list by name and enters named access list configuration mode.

Step 4

[sequence-number] permit tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# permit tcp any any match-any +rst

Specifies a permit statement in named IP access list mode.

- This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need.

- Use the TCP command syntax of the permitcommand.

- Any packet with the RST TCP header flag set will be matched and allowed to pass the named access list kmd1 in Step 3.

Step 5

[sequence-number] deny tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# deny tcp any any match-all -ack -fin

(Optional) Specifies a deny statement in named IP access list mode.

- This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need.

- Use the TCP command syntax of the denycommand.

- Any packet that does not have the ACK flag set, and also does not have the FIN flag set, will not be allowed to pass the named access list kmd1 in Step 3.

- See the deny(IP) command for additional command syntax to permit upper-layer protocols (ICMP, IGMP, TCP, and UDP).

Step 6

Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-numbercommand to delete an entry.

Allows you to revise the access list.

Step 7

end

Example:

Device(config-ext-nacl)# end

(Optional) Exits the configuration mode and returns to privileged EXEC mode.

Step 8

show ip access-lists access-list-name

Example:

Device# show ip access-lists kmd1

(Optional) Displays the contents of the IP access list.

- Review the output to confirm that the access list includes the new entry.

Example: Filtering Packets That Contain TCP Flags

The following access list allows TCP packets only if the TCP flags ACK and SYN are set and the FIN flag is not set:

ip access-list extended aaa
permit tcp any any match-all +ack +syn -fin
end

The show access-list command has been entered to display the ACL:

Device# show access-list aaa

Extended IP access list aaa
10 permit tcp any any match-all +ack +syn -fin

Additional References for Creating an IP Access List to Filter TCP Flags

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security Commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Order of access list entries

"Refining an IP Access List"

Access list entries based on time of day or week

"Refining an IP Access List”

Packets with noninitial fragments

"Refining an IP Access List”

Filtering on IP Options, TCP flags, noncontiguous ports, or TTL values

“Creating an IP Access List to Filter IP Options, TCP Flags, Noncontiguous Ports, or TTL Values”

Access to virtual terminal lines

"Controlling Access to a Virtual Terminal Line”

Routing updates and policy routing

“Configuring Routing Protocol-Independent Features” modules in the Cisco IOS IP Routing Protocols Configuration Guide

Traffic identification or classification for features such as congestion avoidance, congestion management, and priority queuing

“Regulating Packet Flow on a Per-Interface Basis--Using Generic Traffic Shaping” module in the Quality of Service Solutions Configuration Guide

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Creating an IP Access List to Filter TCP Flags

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Creating an IP Access List to Filter TCP Flags

Feature Name

Releases

Feature Configuration Information

ACL TCP Flags Filtering

Cisco IOS 15.2(2)E

This feature provides a flexible mechanism for filtering on TCP flags.

The ACL TCP Flags Filtering feature allows you to select any combination of flags on which to filter. The ability to match on a flag set and on a flag not set gives you a greater degree of control for filtering on TCP flags, thus enhancing security.

Chapter 6. IPv6 ACL Extensions for Hop by Hop Filtering

The IPv6 ACL Extensions for Hop by Hop Filtering feature allows you to control IPv6 traffic that might contain hop-by-hop extension headers. You can configure an access control list (ACL) to deny all hop-by-hop traffic or to selectively permit traffic based on protocol.

- Finding Feature Information

- Information About IPv6 ACL Extensions for Hop by Hop Filtering

- How to Configure IPv6 ACL Extensions for Hop by Hop Filtering

- Configuration Example for IPv6 ACL Extensions for Hop by Hop Filtering

- Additional References

- Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Information About IPv6 ACL Extensions for Hop by Hop Filtering

- ACLs and Traffic Forwarding

ACLs and Traffic Forwarding

IPv6 access control lists (ACLs) determine what traffic is blocked and what traffic is forwarded at device interfaces. ACLs allow filtering based on source and destination addresses, inbound and outbound to a specific interface. Use the ipv6 access-list command to define an IPv6 ACL, and the deny and permit commands to configure its conditions.

The IPv6 ACL Extensions for Hop by Hop Filtering feature implements RFC 2460 to support traffic filtering in any upper-layer protocol type.

How to Configure IPv6 ACL Extensions for Hop by Hop Filtering

- Configuring IPv6 ACL Extensions for Hop by Hop Filtering

Configuring IPv6 ACL Extensions for Hop by Hop Filtering

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 access-list access-list-name

4.    permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

5.    deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]

6.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 access-list access-list-name

Example:

Device(config)# ipv6 access-list hbh-acl

Defines an IPv6 ACL and enters IPv6 access list configuration mode.

Step 4

permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

Example:

Device(config-ipv6-acl)# permit icmp any any dest-option-type

Sets permit conditions for the IPv6 ACL.

Step 5

deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]

Example:

Device(config-ipv6-acl)# deny icmp any any dest-option-type

Sets deny conditions for the IPv6 ACL.

Step 6

end

Example:

Device (config-ipv6-acl)# end

Returns to privileged EXEC configuration mode.

Configuration Example for IPv6 ACL Extensions for Hop by Hop Filtering

- Example: IPv6 ACL Extensions for Hop by Hop Filtering

Example: IPv6 ACL Extensions for Hop by Hop Filtering

Device(config)# ipv6 access-list hbh_acl
Device(config-ipv6-acl)# permit tcp any any hbh
Device(config-ipv6-acl)# permit tcp any any
Device(config-ipv6-acl)# permit udp any any
Device(config-ipv6-acl)# permit udp any any hbh
Device(config-ipv6-acl)# permit hbh any any
Device(config-ipv6-acl)# permit any any
Device(config-ipv6-acl)# hardware statistics
Device(config-ipv6-acl)# exit

! Assign an IP address and add the ACL on the interface.

Device(config)# interface FastEthernet3/1
Device(config-if)# ipv6 address 1001::1/64
Device(config-if)# ipv6 traffic-filter hbh_acl in
Device(config-if)# exit
Device(config)# exit
Device# clear counters
Clear "show interface" counters on all interfaces [confirm]
Device#

! Verify the configurations.

Device# show running-config interface FastEthernet3/1

Building configuration...

Current configuration : 114 bytes
!
interface FastEthernet3/1
no switchport
ipv6 address 1001::1/64
ipv6 traffic-filter hbh_acl
end

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

IPv6 addressing and basic connectivity

IPv6 Addressing and Basic Connectivity Configuration Guide

IPv6 features

IPv6 Feature Mapping

RFCs for IPv6

IPv6 RFCs

Standards and RFCs

Standard/RFC

Title

RFC 2460

Internet Protocol, Version 6 (IPv6)

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

Feature Name

Releases

Feature Information

IPv6 ACL Extensions for Hop by Hop Filtering

15.1(1)SG

15.1(1)SY

15.2(3)T

15.3(1)S

Allows you to control IPv6 traffic that might contain hop-by-hop extension headers.

The following commands were introduced or modified: deny (IPv6), permit (IPv6).

Chapter 7. IP Access List Entry Sequence Numbering

Users can apply sequence numbers to permit or deny statements and also reorder, add, or remove such statements from a named IP access list. This feature makes revising IP access lists much easier. Prior to this feature, users could add access list entries to the end of an access list only; therefore needing to add statements anywhere except the end required reconfiguring the access list entirely.

- Finding Feature Information

- Restrictions for IP Access List Entry Sequence Numbering

- Information About IP Access List Entry Sequence Numbering

- How to Use Sequence Numbers in an IP Access List

- Configuration Examples for IP Access List Entry Sequence Numbering

- Additional References for IP Access List Entry Sequence Numbering

- Feature Information for IP Access List Entry Sequence Numbering

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for IP Access List Entry Sequence Numbering

- This feature does not support dynamic, reflexive, or firewall access lists.

- This feature does not support old-style numbered access lists, which existed before named access lists. Keep in mind that you can name an access list with a number, so numbers are allowed when they are entered in the standard or extended named access list (NACL) configuration mode.

Information About IP Access List Entry Sequence Numbering

- Purpose of IP Access Lists

- How an IP Access List Works

- IP Access List Entry Sequence Numbering

Purpose of IP Access Lists

Access lists perform packet filtering to control which packets move through the network and where. Such control can help limit network traffic and restrict the access of users and devices to the network. Access lists have many uses, and therefore many commands accept a reference to an access list in their command syntax. Access lists can be used to do the following:

- Filter incoming packets on an interface.

- Filter outgoing packets on an interface.

- Restrict the contents of routing updates.

- Limit debug output based on an address or protocol.

- Control virtual terminal line access.

- Identify or classify traffic for advanced features, such as congestion avoidance, congestion management, and priority and custom queuing.

- Trigger dial-on-demand routing (DDR) calls.

How an IP Access List Works

An access list is a sequential list consisting of at least one permit statement and possibly one or more deny statements that apply to IP addresses and possibly upper-layer IP protocols. The access list has a name by which it is referenced. Many software commands accept an access list as part of their syntax.

An access list can be configured and named, but it is not in effect until the access list is referenced by a command that accepts an access list. Multiple commands can reference the same access list. An access list can control traffic arriving at the device or leaving the device, but not traffic originating at the device.

- IP Access List Process and Rules

- Helpful Hints for Creating IP Access Lists

- Source and Destination Addresses

- Wildcard Mask and Implicit Wildcard Mask

- Transport Layer Information

IP Access List Process and Rules

- The software tests the source or destination address or the protocol of each packet being filtered against the conditions in the access list, one condition (permit or deny statement) at a time.

- If a packet does not match an access list statement, the packet is then tested against the next statement in the list.

- If a packet and an access list statement match, the rest of the statements in the list are skipped and the packet is permitted or denied as specified in the matched statement. The first entry that the packet matches determines whether the software permits or denies the packet. That is, after the first match, no subsequent entries are considered.

- If the access list denies the address or protocol, the software discards the packet and returns an ICMP Host Unreachable message.

- If no conditions match, the software drops the packet. This is because each access list ends with an unwritten or implicit deny statement. That is, if the packet has not been permitted by the time it was tested against each statement, it is denied.

- The access list must contain at least one permit statement or else all packets are denied.

- Because the software stops testing conditions after the first match, the order of the conditions is critical. The same permit or deny statements specified in a different order could result in a packet being passed under one circumstance and denied in another circumstance.

- If an access list is referenced by name in a command, but the access list does not exist, all packets pass.

- Only one access list per interface, per protocol, per direction is allowed.

- Inbound access lists process packets arriving at the device. Incoming packets are processed before being routed to an outbound interface. An inbound access list is efficient because it saves the overhead of routing lookups if the packet is to be discarded because it is denied by the filtering tests. If the packet is permitted by the tests, it is then processed for routing. For inbound lists, permit means continue to process the packet after receiving it on an inbound interface; deny means discard the packet.

- Outbound access lists process packets before they leave the device. Incoming packets are routed to the outbound interface and then processed through the outbound access list. For outbound lists, permit means send it to the output buffer; deny means discard the packet.

Helpful Hints for Creating IP Access Lists

- Create the access list before applying it to an interface. An interface with an empty access list applied to it permits all traffic.

- Another reason to configure an access list before applying it is because if you applied a nonexistent access list to an interface and then proceed to configure the access list, the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems.

- Because the software stops testing conditions after it encounters the first match (to either a permit or deny statement), you will reduce processing time and resources if you put the statements that packets are most likely to match at the beginning of the access list. Place more frequently occurring conditions before less frequent conditions.

- Organize your access list so that more specific references in a network or subnet appear before more general ones.

- In order to make the purpose of individual statements more easily understood at a glance, you can write a helpful remark before or after any statement.

Source and Destination Addresses

Source and destination address fields in an IP packet are two typical fields on which to base an access list. Specify source addresses to control the packets being sent from certain networking devices or hosts. Specify destination addresses to control the packets being sent to certain networking devices or hosts.

Wildcard Mask and Implicit Wildcard Mask

When comparing the address bits in an access list entry to a packet being submitted to the access list, address filtering uses wildcard masking to determine whether to check or ignore the corresponding IP address bits. By carefully setting wildcard masks, an administrator can select one or more IP addresses for permit or deny tests.

Wildcard masking for IP address bits uses the number 1 and the number 0 to specify how the software treats the corresponding IP address bits. A wildcard mask is sometimes referred to as an inverted mask because a 1 and 0 mean the opposite of what they mean in a subnet (network) mask.

- A wildcard mask bit 0 means check the corresponding bit value.

- A wildcard mask bit 1 means ignore that corresponding bit value.

If you do not supply a wildcard mask with a source or destination address in an access list statement, the software assumes a default wildcard mask of 0.0.0.0.

Unlike subnet masks, which require contiguous bits indicating network and subnet to be ones, wildcard masks allow noncontiguous bits in the mask.

Transport Layer Information

You can filter packets based on transport layer information, such as whether the packet is a TCP, UDP, Internet Control Message Protocol (ICMP) or Internet Group Management Protocol (IGMP) packet.

IP Access List Entry Sequence Numbering

- Benefits

- Sequence Numbering Behavior

Benefits

The ability to apply sequence numbers to IP access list entries simplifies access list changes. Prior to the IP Access List Entry Sequence Numbering feature, there was no way to specify the position of an entry within an access list. If a user wanted to insert an entry (statement) in the middle of an existing list, all of the entries after the desired position had to be removed, then the new entry was added, and then all the removed entries had to be reentered. This method was cumbersome and error prone.

This feature allows users to add sequence numbers to access list entries and resequence them. When a user adds a new entry, the user chooses the sequence number so that it is in a desired position in the access list. If necessary, entries currently in the access list can be resequenced to create room to insert the new entry.

Sequence Numbering Behavior

- For backward compatibility with previous releases, if entries with no sequence numbers are applied, the first entry is assigned a sequence number of 10, and successive entries are incremented by 10. The maximum sequence number is 2147483647. If the generated sequence number exceeds this maximum number, the following message is displayed:

Exceeded maximum sequence number.

- If you enter an entry without a sequence number, it is assigned a sequence number that is 10 greater than the last sequence number in that access list and is placed at the end of the list.

- If you enter an entry that matches an already existing entry (except for the sequence number), then no changes are made.

- If you enter a sequence number that is already present, the following error message is generated:

Duplicate sequence number.

- If a new access list is entered from global configuration mode, then sequence numbers for that access list are generated automatically.

- Distributed support is provided so that the sequence numbers of entries in the Route Processor (RP) and line card (LC) are always synchronized.

- Sequence numbers are not nvgened. That is, the sequence numbers themselves are not saved. In the event that the system is reloaded, the configured sequence numbers revert to the default sequence starting number and increment from that number. The function is provided for backward compatibility with software releases that do not support sequence numbering.

- The IP Access List Entry Sequence Numbering feature works with named standard and extended IP access lists. Because the name of an access list can be designated as a number, numbers are acceptable.

How to Use Sequence Numbers in an IP Access List

- Sequencing Access-List Entries and Revising the Access List

Sequencing Access-List Entries and Revising the Access List

This task shows how to assign sequence numbers to entries in a named IP access list and how to add or delete an entry to or from an access list. It is assumed a user wants to revise an access list. The context of this task is the following:

- A user need not resequence access lists for no reason; resequencing in general is optional. The resequencing step in this task is shown as required because that is one purpose of this feature and this task demonstrates the feature.

- Step 5 happens to be a permit statement and Step 6 happens to be a deny statement, but they need not be in that order.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list resequence access-list-name starting-sequence-number increment

4.    ip access-list {standard| extended} access-list-name

5.    Do one of the following:

- sequence-number permit source source-wildcard

- sequence-number permit protocol source source-wildcard destination destination-wildcard [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

6.    Do one of the following:

- sequence-number deny source source-wildcard

- sequence-number deny protocol source source-wildcard destination destination-wildcard [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

7.    Repeat Step 5 and/or Step 6 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.

8.    end

9.    show ip access-lists access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode. Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list resequence access-list-name starting-sequence-number increment

Example:

Device(config)# ip access-list resequence kmd1 100 15

Resequences the specified IP access list using the starting sequence number and the increment of sequence numbers.

- This example resequences an access list named kmd1. The starting sequence number is 100 and the increment is 15.

Step 4

ip access-list {standard| extended} access-list-name

Example:

Device(config)# ip access-list standard kmd1

Specifies the IP access list by name and enters named access list configuration mode.

- If you specify standard, make sure you subsequently specify permit and/or deny statements using the standard access list syntax.

- If you specify extended, make sure you subsequently specify permit and/or deny statements using the extended access list syntax.

Step 5

Do one of the following:

- sequence-number permit source source-wildcard

- sequence-number permit protocol source source-wildcard destination destination-wildcard [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-std-nacl)# 105 permit 10.5.5.5 0.0.0 255

Specifies a permit statement in named IP access list mode.

- This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need.

- See the permit (IP) command for additional command syntax to permit upper layer protocols (ICMP, IGMP, TCP, and UDP).

- Use the no sequence-number command to delete an entry.

- As the prompt indicates, this access list was a standard access list. If you had specified extended in Step 4, the prompt for this step would be Device(config-ext-nacl) and you would use the extended permit command syntax.

Step 6

Do one of the following:

- sequence-number deny source source-wildcard

- sequence-number deny protocol source source-wildcard destination destination-wildcard [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-std-nacl)# 105 deny 10.6.6.7 0.0.0 255

(Optional) Specifies a deny statement in named IP access list mode.

- This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need.

- See the deny (IP) command for additional command syntax to permit upper layer protocols (ICMP, IGMP, TCP, and UDP).

- Use the no sequence-number command to delete an entry.

- As the prompt indicates, this access list was a standard access list. If you had specified extended in Step 4, the prompt for this step would be Device(config-ext-nacl) and you would use the extended deny command syntax.

Step 7

Repeat Step 5 and/or Step 6 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.

Allows you to revise the access list.

Step 8

end

Example:

Device(config-std-nacl)# end

(Optional) Exits the configuration mode and returns to privileged EXEC mode.

Step 9

show ip access-lists access-list-name

Example:

Device# show ip access-lists kmd1

(Optional) Displays the contents of the IP access list.

- Review the output to see that the access list includes the new entry.

Device# show ip access-lists kmd1

Standard IP access list kmd1

100 permit 10.4.4.0, wildcard bits 0.0.0.255

105 permit 10.5.5.0, wildcard bits 0.0.0.255

115 permit 10.0.0.0, wildcard bits 0.0.0.255

130 permit 10.5.5.0, wildcard bits 0.0.0.255

145 permit 10.0.0.0, wildcard bits 0.0.0.255

- What to Do Next

What to Do Next

If your access list is not already applied to an interface or line or otherwise referenced, apply the access list. Refer to the “Configuring IP Services” chapter of the Cisco IOS IP Configuration Guide for information about how to apply an IP access list.

Configuration Examples for IP Access List Entry Sequence Numbering

- Example: Resequencing Entries in an Access List

- Example: Adding Entries with Sequence Numbers

- Example: Entry without Sequence Number

Example: Resequencing Entries in an Access List

The following example shows access list resequencing. The starting value is 1, and increment value is 2. The subsequent entries are ordered based on the increment values that users provide, and the range is from 1 to 2147483647.

When an entry with no sequence number is entered, by default it has a sequence number of 10 more than the last entry in the access list.

Device# show access-list 150
Extended IP access list 150
10 permit ip host 10.3.3.3 host 172.16.5.34
20 permit icmp any any
30 permit tcp any host 10.3.3.3
40 permit ip host 10.4.4.4 any
50 Dynamic test permit ip any any
60 permit ip host 172.16.2.2 host 10.3.3.12
70 permit ip host 10.3.3.3 any log
80 permit tcp host 10.3.3.3 host 10.1.2.2
90 permit ip host 10.3.3.3 any
100 permit ip any any
Device(config)# ip access-list extended 150
Device(config)# ip access-list resequence 150 1 2
Device(config)# end
Device# show access-list 150
Extended IP access list 150
1 permit ip host 10.3.3.3 host 172.16.5.34
3 permit icmp any any
5 permit tcp any host 10.3.3.3
7 permit ip host 10.4.4.4 any
9 Dynamic test permit ip any any
11 permit ip host 172.16.2.2 host 10.3.3.12
13 permit ip host 10.3.3.3 any log
15 permit tcp host 10.3.3.3 host 10.1.2.2
17 permit ip host 10.3.3.3 any
19 permit ip any any

Example: Adding Entries with Sequence Numbers

In the following example, a new entry is added to a specified access list:

Device# show ip access-list
Standard IP access list tryon
2 permit 10.4.4.2, wildcard bits 0.0.255.255
5 permit 10.0.0.44, wildcard bits 0.0.0.255
10 permit 10.0.0.1, wildcard bits 0.0.0.255
20 permit 10.0.0.2, wildcard bits 0.0.0.255
Device(config)# ip access-list standard tryon
Device(config-std-nacl)# 15 permit 10.5.5.5 0.0.0.255
Device# show ip access-list
Standard IP access list tryon
2 permit 10.4.0.0, wildcard bits 0.0.255.255
5 permit 10.0.0.0, wildcard bits 0.0.0.255
10 permit 10.0.0.0, wildcard bits 0.0.0.255
15 permit 10.5.5.0, wildcard bits 0.0.0.255
20 permit 10.0.0.0, wildcard bits 0.0.0.255

Example: Entry without Sequence Number

The following example shows how an entry with no specified sequence number is added to the end of an access list. When an entry is added without a sequence number, it is automatically given a sequence number that puts it at the end of the access list. Because the default increment is 10, the entry will have a sequence number 10 higher than the last entry in the existing access list.

Device(config)# ip access-list standard 1
Device(config-std-nacl)# permit 1.1.1.1 0.0.0.255
Device(config-std-nacl)# permit 2.2.2.2 0.0.0.255
Device(config-std-nacl)# permit 3.3.3.3 0.0.0.255
Device# show access-list
Standard IP access list 1
10 permit 0.0.0.0, wildcard bits 0.0.0.255
20 permit 0.0.0.0, wildcard bits 0.0.0.255
30 permit 0.0.0.0, wildcard bits 0.0.0.255
Device(config)# ip access-list standard 1
Device(config-std-nacl)# permit 4.4.4.4 0.0.0.255
Device(config-std-nacl)# end
Device# show access-list
Standard IP access list 1
10 permit 0.0.0.0, wildcard bits 0.0.0.255
20 permit 0.0.0.0, wildcard bits 0.0.0.255
30 permit 0.0.0.0, wildcard bits 0.0.0.255
40 permit 0.4.0.0, wildcard bits 0.0.0.255

Additional References for IP Access List Entry Sequence Numbering

The following sections provide references related to IP access lists.

Related Documents

Related Topic

Document Title

Configuring IP access lists

"Creating an IP Access List and Applying It to an Interface"

Cisco IOS commands

Cisco IOS Master Command List, All Releases

IP access list commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature Information for IP Access List Entry Sequence Numbering

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IP Access List Entry Sequence Numbering

Feature Name

Releases

Feature Information

IP Access List Entry Sequence Numbering

IOS 15.2(2)E

Users can apply sequence numbers to permit or deny statements and also reorder, add, or remove such statements from a named IP access list. This feature makes revising IP access lists much easier. Prior to this feature, users could add access list entries to the end of an access list only; therefore needing to add statements anywhere except the end required reconfiguring the access list entirely.

In Cisco IOS 15.2(2)E, , support was added for the Cisco Catalyst 3850 Series Switches.

The following commands were introduced or modified: deny (IP), ip access-list resequence deny (IP), permit (IP).

Chapter 8. IP Named Access Control Lists

Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting the access of traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall.

The IP Named Access Control Lists feature gives network administrators the option of using names to identify their access lists.

This module describes IP named access lists and how to configure them.

- Finding Feature Information

- Additional References for IP Named Access Control Lists

- Feature Information for IP Named Access Control Lists

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Definition of an Access List

Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting the access of traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall.

IP access lists can also be used for purposes other than security, such as to control bandwidth, restrict the content of routing updates, redistribute routes, trigger dial-on-demand (DDR) calls, limit debug output, and identify or classify traffic for quality of service (QoS) features.

An access list is a sequential list that consists of at least one permit statement and possibly one or more deny statements. In the case of IP access lists, these statements can apply to IP addresses, upper-layer IP protocols, or other fields in IP packets.

Access lists are identified and referenced by a name or a number. Access lists act as packet filters, filtering packets based on the criteria defined in each access list.

After you configure an access list, for the access list to take effect, you must either apply the access list to an interface (by using the ip access-group command), a vty (by using the access-class command), or reference the access list by any command that accepts an access list. Multiple commands can reference the same access list.

In the following configuration, an IP access list named branchoffices is configured on Fast Ethernet interface 0/1/0 and applied to incoming packets. Networks other than the ones specified by the source address and mask pair cannot access Fast Ethernet interface 0/1/0. The destinations for packets coming from sources on network 172.16.7.0 are unrestricted. The destination for packets coming from sources on network 172.16.2.0 must be 172.31.5.4.

ip access-list extended branchoffices
10 permit 172.16.7.0 0.0.0.3 any
20 permit 172.16.2.0 0.0.0.255 host 172.31.5.4
!
interface fastethernet 0/1/0
ip access-group branchoffices in

Named or Numbered Access Lists

All access lists must be identified by a name or a number. Named access lists are more convenient than numbered access lists because you can specify a meaningful name that is easier to remember and associate with a task. You can reorder statements in or add statements to a named access list.

Named access lists support the following features that are not supported by numbered access lists:

- IP options filtering

- Noncontiguous ports

- TCP flag filtering

- Deleting of entries with the no permit or no deny command

Note

Not all commands that accept a numbered access list will accept a named access list. For example, vty uses only numbered access lists.

Benefits of IP Access Lists

Access control lists (ACLs) perform packet filtering to control the flow of packets through a network. Packet filtering can restrict the access of users and devices to a network, providing a measure of security. Access lists can save network resources by reducing traffic. The benefits of using access lists are as follows:

- Authenticate incoming rsh and rcp requests—Access lists can simplify the identification of local users, remote hosts, and remote users in an authentication database that is configured to control access to a device. The authentication database enables Cisco software to receive incoming remote shell (rsh) and remote copy (rcp) protocol requests.

- Block unwanted traffic or users—Access lists can filter incoming or outgoing packets on an interface, thereby controlling access to a network based on source addresses, destination addresses, or user authentication. You can also use access lists to determine the types of traffic that are forwarded or blocked at device interfaces. For example, you can use access lists to permit e-mail traffic to be routed through a network and to block all Telnet traffic from entering the network.

- Control access to vty—Access lists on an inbound vty (Telnet) can control who can access the lines to a device. Access lists on an outbound vty can control the destinations that the lines from a device can reach.

- Identify or classify traffic for QoS features—Access lists provide congestion avoidance by setting the IP precedence for Weighted Random Early Detection (WRED) and committed access rate (CAR). Access lists also provide congestion management for class-based weighted fair queueing (CBWFQ), priority queueing, and custom queueing.

- Limit debug command output—Access lists can limit debug output based on an IP address or a protocol.

- Provide bandwidth control—Access lists on a slow link can prevent excess traffic on a network.

- Provide NAT control—Access lists can control which addresses are translated by Network Address Translation (NAT).

- Reduce the chance of DoS attacks—Access lists reduce the chance of denial-of-service (DoS) attacks. Specify IP source addresses to control traffic from hosts, networks, or users from accessing your network. Configure the TCP Intercept feature to can prevent servers from being flooded with requests for connection.

- Restrict the content of routing updates—Access lists can control routing updates that are sent, received, or redistributed in networks.

- Trigger dial-on-demand calls—Access lists can enforce dial and disconnect criteria.

Access List Rules

The following rules apply to access lists:

- Only one access list per interface, per protocol, and per direction is allowed.

- An access list must contain at least one permit statement or all packets are denied entry into the network.

- The order in which access list conditions or match criteria are configured is important. While deciding whether to forward or block a packet, Cisco software tests the packet against each criteria statement in the order in which these statements are created. After a match is found, no more criteria statements are checked. The same permit or deny statements specified in a different order can result in a packet being passed under one circumstance and denied in another circumstance.

- If an access list is referenced by a name, but the access list does not exist, all packets pass. An interface or command with an empty access list applied to it permits all traffic into the network.

- Standard access lists and extended access lists cannot have the same name.

- Inbound access lists process packets before the packets are routed to an outbound interface. Inbound access lists that have filtering criteria that deny packet access to a network saves the overhead of routing lookup. Packets that are permitted access to a network based on the configured filtering criteria are processed for routing. For inbound access lists, when you configure a permit statement, packets are processed after they are received, and when you configure a deny statement, packets are discarded.

- Outbound access lists process packets before they leave the device. Incoming packets are routed to the outbound interface and then processed by the outbound access list. For outbound access lists, when you configure a permit statement, packets are sent to the output buffer, and when you configure a deny statement, packets are discarded.

- An access list can control traffic arriving at a device or leaving a device, but not traffic originating at a device.

Helpful Hints for Creating IP Access Lists

The following tips will help you avoid unintended consequences and help you create more efficient, useful access lists.

- Create the access list before applying it to an interface (or elsewhere), because if you apply a nonexistent access list to an interface and then proceed to configure the access list, the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems.

- Another reason to configure an access list before applying it is because an interface with an empty access list applied to it permits all traffic.

- All access lists need at least one permit statement; otherwise, all packets are denied and no traffic passes.

- Because the software stops testing conditions after it encounters the first match (to either a permit or deny statement), you will reduce processing time and resources if you put the statements that packets are most likely to match at the beginning of the access list. Place more frequently occurring conditions before less frequent conditions.

- Organize your access list so that more specific references in a network or subnet appear before more general ones.

- Use the statement permit any any if you want to allow all other packets not already denied. Using the statement permit any any in effect avoids denying all other packets with the implicit deny statement at the end of an access list. Do not make your first access list entry permit any any because all traffic will get through; no packets will reach the subsequent testing. In fact, once you specify permit any any, all traffic not already denied will get through.

- Although all access lists end with an implicit deny statement, we recommend use of an explicit deny statement (for example, deny ip any any). On most platforms, you can display the count of packets denied by issuing the show access-listcommand, thus finding out more information about who your access list is disallowing. Only packets denied by explicit deny statements are counted, which is why the explicit deny statement will yield more complete data for you.

- While you are creating an access list or after it is created, you might want to delete an entry.

- You cannot delete an entry from a numbered access list; trying to do so will delete the entire access list. If you need to delete an entry, you need to delete the entire access list and start over.

- You can delete an entry from a named access list. Use the no permitor no deny command to delete the appropriate entry.

- In order to make the purpose of individual statements more scannable and easily understood at a glance, you can write a helpful remark before or after any statement by using the remark command.

- If you want to deny access to a particular host or network and find out if someone from that network or host is attempting to gain access, include the log keyword with the corresponding deny statement so that the packets denied from that source are logged for you.

- This hint applies to the placement of your access list. When trying to save resources, remember that an inbound access list applies the filter conditions before the routing table lookup. An outbound access list applies the filter conditions after the routing table lookup.

Where to Apply an Access List

You can apply access lists to the inbound or outbound interfaces of a device. Applying an access list to an inbound interface controls the traffic that enters the interface and applying an access list to an outbound interface controls the traffic that exits the interface.

When software receives a packet at the inbound interface, the software checks the packet against the statements that are configured for the access list. If the access list permits packets, the software processes the packet. Applying access lists to filter incoming packets can save device resources because filtered packets are discarded before entering the device.

Access lists on outbound interfaces filter packets that are transmitted (sent) out of the interface. You can use the TCP Access Control List (ACL) Splitting feature of the Rate-Based Satellite Control Protocol (RBSCP) on the outbound interface to control the type of packets that are subject to TCP acknowledgment (ACK) splitting on an outbound interface.

You can reference an access list by using a debug command to limit the amount of debug logs. For example, based on the filtering or matching criteria of the access list, debug logs can be limited to source or destination addresses or protocols.

You can use access lists to control routing updates, dial-on-demand (DDR), and quality of service (QoS) features.

Creating an IP Named Access List

You can create an IP named access list to filter source addresses and destination addresses or a combination of addresses and other IP fields. Named access lists allow you to identify your access lists with an intuitive name.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended name

4.    remark remark

5.    deny protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]

6.    remark remark

7.    permit protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]

8.    Repeat Steps 4 through 7 to specify more statements for your access list.

9.    end

10.    show ip access-lists

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list extended name

Example:

Device(config)# ip access-list extended acl1

Defines an extended IP access list using a name and enters extended named access list configuration mode.

Step 4

remark remark

Example:

Device(config-ext-nacl)# remark protect server by denying sales access to the acl1 network

(Optional) Adds a description for an access list statement.

- A remark can precede or follow an IP access list entry.

- In this example, the remark command reminds the network administrator that the deny command configured in Step 5 denies the Sales network access to the interface.

Step 5

deny protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]

Example:

Device(config-ext-nacl)# deny ip 192.0.2.0 0.0.255.255 host 192.0.2.10 log

(Optional) Denies all packets that match all conditions specified by the remark.

Step 6

remark remark

Example:

Device(config-ext-nacl)# remark allow TCP from any source to any destination

(Optional) Adds a description for an access list statement.

- A remark can precede or follow an IP access list entry.

Step 7

permit protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]

Example:

Device(config-ext-nacl)# permit tcp any any

Permits all packets that match all conditions specified by the statement.

Step 8

Repeat Steps 4 through 7 to specify more statements for your access list.

Note:
All source addresses that are not specifically permitted by a statement are denied by an implicit deny statement at the end of the access list.

Step 9

end

Example:

Device(config-ext-nacl)# end

Exits extended named access list configuration mode and returns to privileged EXEC mode.

Step 10

show ip access-lists

Example:

Device# show ip access-lists

Displays the contents of all current IP access lists.

Example:

The following is sample output from the show ip access-lists command:

Device# show ip access-lists acl1

Extended IP access list acl1
permit tcp any 192.0.2.0 255.255.255.255 eq telnet
deny tcp any any
deny udp any 192.0.2.0 255.255.255.255 lt 1024
deny ip any any log

Applying an Access List to an Interface

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ip access-group {access-list-number | access-list-name} {in | out}

5.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface fastethernet 0/0/0

Specifies an interface and enters interface configuration mode.

Step 4

ip access-group {access-list-number | access-list-name} {in | out}

Example:

Device(config-if)# ip access-group acl1 in

Applies the specified access list to the inbound interface.

- To filter source addresses, apply the access list to the inbound interface.

Step 5

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Example: Creating an IP Named Access Control List

Device# configure terminal
Device(config)# ip access-list extended acl1
Device(config-ext-nacl)# remark protect server by denying sales access to the acl1 network
Device(config-ext-nacl)# deny ip 192.0.2.0 0.0.255.255 host 192.0.2.10 log
Device(config-ext-nacl)# remark allow TCP from any source to any destination
Device(config-ext-nacl)# permit tcp any any

Example: Applying the Access List to an Interface

Device# configure terminal
Device(config)# interface fastethernet 0/0/0
Device(config-if)# ip access-group acl1 in

Additional References for IP Named Access Control Lists

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IP Named Access Control Lists

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IP Named Access Control Lists

Feature Name

Releases

Feature Information

IP Named Access Control Lists

Cisco IOS 15.2(2)E

Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall.

Chapter 9. IPv6 PACL Support

The IPv6 PACL feature permits or denies the movement of traffic between Layer 3 subnets and VLANs, or within a VLAN.

- Finding Feature Information

- Prerequisites for IPv6 PACL Support

- Additional References for IPv6 PACL Support

- Feature Information for IPv6 PACL Support

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for IPv6 PACL Support

In order to use the IPv6 port-based access control list (PACL) feature, you must know how to configure IPv6 access lists.

IPv6 Port-Based Access Control List Support

The IPv6 PACL feature provides the ability to provide access control (permit or deny) on Layer 2 switch ports for IPv6 traffic. IPv6 PACLs are similar to IPv4 PACLs, which provide access control on Layer 2 switch ports for IPv4 traffic. They are supported only in the ingress direction and in hardware.

A PACL can filter ingress traffic on Layer 2 interfaces based on Layer 3 and Layer 4 header information or non-IP Layer 2 information.

Configuring PACL Mode and Applying IPv6 PACL on an Interface

Before You Begin
Before you configure the IPv6 PACL feature, you must configure an IPv6 access list. Once you have configured the IPv6 access list, you must configure the port-based access control list (PACL) mode on the specified IPv6 Layer 2 interface.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 access-list access-list-name

4.    exit

5.    interface type number

6.    ipv6 traffic-filter access-list-name {in | out}

7.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 access-list access-list-name

Example:

Device(config)# ipv6 access-list list1

Defines an IPv6 ACL and enters IPv6 access list configuration mode.

Step 4

exit

Example:

Device(config-ipv6-acl)# exit

Exits IPv6 access list configuration mode and enters global configuration mode.

Step 5

interface type number

Example:

Device(config)# interface fastethernet 0/0

Specifies an interface type and number and enters interface configuration mode.

Step 6

ipv6 traffic-filter access-list-name {in | out}

Example:

Device(config-if)# ipv6 traffic-filter list1 in

Filters incoming and outgoing IPv6 traffic on an interface.

Step 7

end

Example:

Device(config-if)# end

Exits interface configuration mode and enters privileged EXEC mode.

Example: Configuring PACL Mode and Applying IPv6 PACL on an Interface

Device# configure terminal

Device(config)# ipv6 access-list list1

Device(config-ipv6-acl)# exit

Device(config)# interface fastethernet 0/0

Device(config-if)# ipv6 traffic-filter list1 in

Additional References for IPv6 PACL Support

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

MIBs

MIB

MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 PACL Support

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 PACL Support

Feature Name

Releases

Feature Information

IPv6 PACL Support

The IPv6 PACL feature permits or denies the movement of traffic between port-based interface, Layer 3 subnets, wireless or wired clients, and VLANs, or within a VLAN.

The following command was introduced or modified: ipv6 traffic-filter.

Chapter 10. Named ACL Support for Noncontiguous Ports on an Access Control Entry

The Named ACL Support for Noncontiguous Ports on an Access Control Entry feature allows you to specify noncontiguous ports in a single access control entry, which greatly reduces the number of entries required in an access control list when several entries have the same source address, destination address, and protocol, but differ only in the ports.

- Finding Feature Information

- Prerequisites for Named ACL Support for Noncontiguous Ports on an Access Control Entry

- Additional References for Named ACL Support for Noncontiguous Ports on an Access Control Entry

- Feature Information for Named ACL Support for Noncontiguous Ports on an Access Control Entry

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for Named ACL Support for Noncontiguous Ports on an Access Control Entry

Before you configure the ACL Support for Filtering IP Options feature, you must understand the concepts of the IP access lists.

- "IP Access List Overview"

- "Creating an IP Access List and Applying It to an Interface"

Benefits of Using the Named ACL Support for Noncontiguous Ports on an Access Control Entry Feature

This feature greatly reduces the number of access control entries (ACEs) required in an access control list to handle multiple entries for the same source address, destination address, and protocol. If you maintain large numbers of ACEs, use this feature to consolidate existing groups of access list entries wherever it is possible and when you create new access list entries. When you configure access list entries with noncontiguous ports, you will have fewer access list entries to maintain.

Configuring an Access Control Entry with Noncontiguous Ports

Perform this task to create access list entries that use noncontiguous TCP or UDP port numbers. Although this task uses TCP ports, you could use the UDP syntax of the permit and deny commands to filter noncontiguous UDP ports.

Although this task uses a permit command first, use the permit and deny commands in the order that achieves your filtering goals.

Note

The ACL—Named ACL Support for Noncontiguous Ports on an Access Control Entry feature can be used only with named, extended ACLs.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] deny tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list extended access-list-name

Example:

Device(config)# ip access-list extended acl-extd-1

Specifies the IP access list by name and enters named access list configuration mode.

Step 4

[sequence-number] permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# permit tcp any eq telnet ftp any eq 450 679

Specifies a permit statement in named IP access list configuration mode.

- Operators include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

- If the operator is positioned after the source and source-wildcard arguments, it must match the source port. If the operator is positioned after the destination and destination-wildcard arguments, it must match the destination port.

- The range operator requires two port numbers. You can configure up to 10 ports after the eq and neqoperators. All other operators require one port number.

- To filter UDP ports, use the UDP syntax of this command.

Step 5

[sequence-number] deny tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# deny tcp any neq 45 565 632

(Optional) Specifies a deny statement in named access list configuration mode.

- Operators include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

- If the operator is positioned after the source and source-wildcard arguments, it must match the source port. If the operator is positioned after the destination and destination-wildcard arguments, it must match the destination port.

- The range operator requires two port numbers. You can configure up to 10 ports after the eq and neqoperators. All other operators require one port number.

- To filter UDP ports, use the UDP syntax of this command.

Step 6

Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.

Allows you to revise the access list.

Step 7

end

Example:

Device(config-ext-nacl)# end

(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.

Step 8

show ip access-lists access-list-name

Example:

Device# show ip access-lists kmd1

(Optional) Displays the contents of the access list.

Consolidating Access List Entries with Noncontiguous Ports into One Access List Entry

Perform this task to consolidate a group of access list entries with noncontiguous ports into one access list entry.

Although this task uses TCP ports, you could use the UDP syntax of the permit and deny commands to filter noncontiguous UDP ports.

Although this task uses a permit command first, use the permit and deny commands in the order that achieves your filtering goals.

SUMMARY STEPS

1.    enable

2.    show ip access-lists access-list-name

3.    configure terminal

4.    ip access-list extended access-list-name

5.    no [sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

6.    [sequence-number] permit protocol source source-wildcard[operator port[port]] destination destination-wildcard[operator port[port]] [option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

7.    Repeat Steps 5 and 6 as necessary, adding permit or deny statements to consolidate access list entries where possible. Use the no sequence-number command to delete an entry.

8.    end

9.    show ip access-lists access-list-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

show ip access-lists access-list-name

Example:

Device# show ip access-lists mylist1

(Optional) Displays the contents of the IP access list.

- Review the output to see if you can consolidate any access list entries.

Step 3

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 4

ip access-list extended access-list-name

Example:

Device(config)# ip access-list extended mylist1

Specifies the IP access list by name and enters named access list configuration mode.

Step 5

no [sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# no 10

Removes the redundant access list entry that can be consolidated.

- Repeat this step to remove entries to be consolidated because only the port numbers differ.

- After this step is repeated to remove the access list entries 20, 30, and 40, for example, those entries are removed because they will be consolidated into one permit statement.

- If a sequence-number is specified, the rest of the command syntax is optional.

Step 6

[sequence-number] permit protocol source source-wildcard[operator port[port]] destination destination-wildcard[operator port[port]] [option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

Example:

Device(config-ext-nacl)# permit tcp any neq 45 565 632 any eq 23 45 34 43

Specifies a permit statement in named access list configuration mode.

- In this instance, a group of access list entries with noncontiguous ports was consolidated into one permit statement.

- You can configure up to 10 ports after the eq and neq operators.

Step 7

Repeat Steps 5 and 6 as necessary, adding permit or deny statements to consolidate access list entries where possible. Use the no sequence-number command to delete an entry.

Allows you to revise the access list.

Step 8

end

Example:

Device(config-std-nacl)# end

(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.

Step 9

show ip access-lists access-list-name

Example:

Device# show ip access-lists mylist1

(Optional) Displays the contents of the access list.

Example: Creating an Access List Entry with Noncontiguous Ports

The following access list entry can be created because up to ten ports can be entered after the eq and neq operators:

ip access-list extended aaa
permit tcp any eq telnet ftp any eq 23 45 34
end

Enter the show access-lists command to display the newly created access list entry.

Device# show access-lists aaa

Extended IP access list aaa
10 permit tcp any eq telnet ftp any eq 23 45 34

Example: Consolidating Some Existing Access List Entries into One Access List Entry with Noncontiguous Ports

The show access-lists command is used to display a group of access list entries for the access list named abc:

Device# show access-lists abc
Extended IP access list abc
10 permit tcp any eq telnet any eq 450
20 permit tcp any eq telnet any eq 679
30 permit tcp any eq ftp any eq 450
40 permit tcp any eq ftp any eq 679

Because the entries are all for the same permit statement and simply show different ports, they can be consolidated into one new access list entry. The following example shows the removal of the redundant access list entries and the creation of a new access list entry that consolidates the previously displayed group of access list entries:

ip access-list extended abc
no 10
no 20
no 30
no 40
permit tcp any eq telnet ftp any eq 450 679
end

When the show access-lists command is reentered, the consolidated access list entry is displayed:

Device# show access-lists abc
Extended IP access list abc
10 permit tcp any eq telnet ftp any eq 450 679

Additional References for Named ACL Support for Noncontiguous Ports on an Access Control Entry

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Overview information about access lists

"IP Access List Overview"

Standards and RFCs

Standards/RFCs

Title

RFC 791

Internet Protocol

RFC 793

Transmission Control Protocol

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Named ACL Support for Noncontiguous Ports on an Access Control Entry

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for ACL Support for Filtering IP Options

Feature Name

Releases

Feature Information

Named ACL Support for Noncontiguous Ports on an Access Control Entry

Cisco IOS 15.2(2)E

The Named ACL Support for Noncontiguous Ports on an Access Control Entry feature allows you to specify noncontiguous ports in a single access control entry, which greatly reduces the number of entries required in an access control list when several entries have the same source address, destination address, and protocol, but differ only in the ports.