sequence-number

Specify a sequence number to permit or deny statements to order the statement in the list . You also can use sequence numbers to reorder, add, or remove statements in a list.

protocol

Name or number of a protocol; valid values are eigrp , gre , icmp , igmp , igrp , ip , ipinip , nos , ospf , tcp , or udp , or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including Internet Control Message Protocol (ICMP), TCP, and User Datagram Protocol (UDP), use the keyword ip . See the “Usage Guidelines” section for additional qualifiers.

object-groupservice-group

Specify an object group of type service .

src-addr

Number of the source network or host from which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

src-wildcard

Wildcard bits to be applied to source network in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

Specifies any source or any destination host as an abbreviation for the source-addr or destination-addr value and the source-wildcard or destination-wildcard value of 0.0.0.0 255.255.255.255.

host addr

Specifies the source or destination address of a single host.

tcp

Specifies the TCP protocol.

udp

Specifies the UDP protocol.

object-group source-addr-group-name

Specifies the name of the object-group that contains the group of source addresses. The source and destination object groups must be network object groups. You cannot use empty object groups in access control lists.

destination-addr

Number of the network or host to which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

destination-wildcard

Wildcard bits to be applied to the destination in a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

object-group dest-addr-group-name

Specifies the name of the object-group that contains the group of destination addresses. The source and destination object groups must be network object groups. You cannot use empty object groups in access control lists.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message for a standard list includes the access list number, whether the packet was permitted or denied, the source address, and the number of packets.

The message for an extended list includes the access list number; whether the packet was permitted or denied; the protocol; whether the protocol was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and source and destination port numbers.

For both standard and extended lists, the message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from reloading because of too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

standard

Specifies a standard IP access list. You can only filter based on the source with standard IP access lists.

extended

Specifies an extended IP access list. Required for object-group ACLs.

access-list-name

Name of the IP access list or object-group ACL. Names cannot contain a space or quotation mark, and must begin with an alphabetic character to prevent ambiguity with numbered access lists.

access-list-number

Number of the access list.

• A standard IP access list is in the ranges 1-99 or 1300-1999.

• An extended IP access list is in the ranges 100-199 or 2000-2699.

sequence-number

Specify a sequence number to permit or deny statements to position the statement in the list. You can also use sequence numbers to reorder, add, or remove statements in a list.

protocol

Name or number of a protocol; valid values are; valid values are ahp , eigrp , esp , gre , icmp , igmp , igrp , ip , ipinip , nos , ospf , , tcp , pcp , pim , udp , or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including Internet Control Message Protocol (ICMP), TCP, and User Datagram Protocol (UDP), use the keyword ip . See the “Usage Guidelines” section for additional qualifiers.

object-groupservice-group

Specify an object group of type service .

source-addr

(Optional) Number of the network or host from which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

source-wildcard

(Optional) Wildcard bits to be applied to the source in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

any

Specifies any source or any destination host as an abbreviation for the source-addr or destination-addr value and the source-wildcard or destination-wildcard value of 0.0.0.0 255.255.255.255.

host address name

Specifies the source or destination address and name of a single host.

object-group source-addr-group-name

Specifies the name of the object group that contains the group of source addresses. The source and destination object groups must be network object groups. You cannot use empty object groups in access control lists.

destination-addr

Number of the network or host to which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

destination-wildcard

Wildcard bits to be applied to the destination in a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

object-group dest-addr-group-name

Specifies the name of the object-group that contains the group of destination addresses. The source and destination object groups must be network object groups. You cannot use empty object groups in access control lists.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message for a standard list includes the access list number, whether the packet was permitted or denied, the source address, and the number of packets.

The message for an extended list includes the access list number; whether the packet was permitted or denied; the protocol; whether the protocol was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and port numbers and the user-defined cookie or router-generated hash value.

For both standard and extended lists, the message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from reloading because of too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

After you specify the log keyword (and the associated word argument), you cannot specify any other keywords or settings for this command.

tcp

Specifies the TCP protocol.

udp

Specifies the UDP protocol.

sequence-number

Permits statements to position the statement in the list.

permit

Sets permit conditions for an IPv6 access list.

ipv6

Sets the IPv6 address to set permit conditions.

any ipv6-address

Specifies any source or any destination host as an abbreviation for the source-addr or destination-addr value and the source-wildcard or destination-wildcard value of 0.0.0. 255.255.255.255.