Configure an IP ACE
Configure an IP ACE to filter on the source IP address, destination IP address, DiffServ Code Point (DSCP), protocol, IP options, IP fragmentation, and routed packets only.
Before you begin
The ACL exists.
The ACE exists.
About this task
The eq and mask parameters specify an operator for a field match condition: equal to or mask. The mask operator is an implied eq on the mask bits.
Procedure
Example
Switch:1(config)#filter acl ace ip 1 12 dst-ip eq 198.51.100.0
Variable definitions
Use the data in the following table to use the filter acl ace ip command.
Variable |
Value |
---|---|
<1-2000> |
Specifies the ACE ID. |
<1-2048> |
Specifies the ACL ID. |
{<0–32>|null|<A.B.C.D>} |
Specifies the mask value for the destination or source IP address For example: filter acl ace ip 10 10 dst-ip mask 198.51.100.0 25 filter acl ace ip 10 10 dst-ip mask 198.51.100.1 203.0.113.0 filter acl ace ip 10 10 src-ip mask 198.51.100.2 22 filter acl ace ip 10 10 src-ip mask 198.51.100.3 203.0.113.1 |
<noFragment|anyFragment> |
Specifies a match option for IP fragments noFragment or anyFragment. |
{<0..63>|<0x00..0x3f>|phbcs0|phbcs1|phbaf11|phbaf12|phbaf13|phbcs2|phbaf21|phbaf22|phbaf23|phbcs3|phbaf31|phbaf32|phbaf33|phbcs4|phbaf41|phbaf42|phbaf43|phbcs5|phbcs6|phbef|phbcs7} |
Specifies the DSCP value using one of the following formats:
|
WORD<0x0-0x40> |
Specifies the mask value, for example, filter acl ace ip 10 10 dscp mask 129 0x40 |
WORD<1-256> |
Specifies one or more IP protocol types: (1–256), or tcp, udp, ipsecesp, vrrp, snmp or undefined. |
WORD<1–1024> |
Specifies the destination or source IP address (a.b.c.d).
|