filter acl ace ip

Use IP access control entries (ACEs) to filter on the source IP address, destination IP address, DiffServ Code Point (DSCP), protocol, IP options, IP fragmentation parameters, and routed packets.

Syntax

Command Parameters

<1-2000>

Specifies the ACE ID.

<1-2048>

Specifies the ACL ID.

dscp <eq|mask> WORD <0-256>
The <eq|mask> parameter specifies an operator for a field match condition. The equals to parameter specifies the PHB name or DSCP value {0 to 256, where 256 => disable}, or:
  • phbcs0

  • phbcs1

  • phbaf11

  • phbaf12

  • phbaf13

  • phbcs2

  • phbaf21

  • phbaf22

  • phbaf23

  • phbcs3

  • phbaf31

  • phbaf32

  • phbaf33

  • phbcs4

  • phbaf41

  • phbaf42

  • phbaf43

  • phbcs5

  • phbcs6

  • phbef

  • phbcs7

dst-ip <eq|mask> WORD <1-1024>
The <eq|mask> parameter specifies an operator for a field match condition.
The WORD<1-1024> parameter specifies the destination IP address list in one of the following formats:
  • a.b.c.d

  • [w.x.y.z-p.q.r.s]

  • [l.m.n.o/mask]

  • [a.b.c.d/len]

ip-frag-flag eq <noFragment|anyFragment>
The eq parameter specifies an operator for a field match condition: equal to.
The ip-frag-flag parameter specifies a match option for IP fragments: noFragment or anyFragment.
ip-options any
Matches to an IP option. Any is the only option.
ip-protocol-type <eq> WORD <1-256>
The <eq> parameter specifies an operator for a field match condition: equal to.
The WORD<1-256> parameter specifies one or more IP protocol types:
  • (1-256)

  • icmp

  • tcp

  • udp

  • ipsecesp

  • ipsecah

  • ospf

  • vrrp

  • undefined

src-ip <eq|mask> WORD <1-1024>
The <eq|mask> parameter specifies an operator for a field match condition: equal to, not equal to, less than or equal to, greater than or equal to.
The WORD<1-1024> parameter specifies a source IP address list in one of the following formats:
  • a.b.c.d

  • [w.x.y.z-p.q.r.s]

  • [l.m.n.o/mask]

  • [a.b.c.d/len]

routed-only
Specifies a field match condition for IPv4 routed packets only. The default is disabled.

Default

None

Command Mode

Global Configuration

Usage Guidelines

The routed-only parameter is not supported for multicast packets.