ip access-list
Creates a standard or extended IPv4 access control list (ACL). In ACLs, you can define rules that permit or deny network traffic based on criteria that you specify.
Syntax
ip access-list
{
standard
|
extended
}
ACLname
no ip access-list
{
standard
|
extended
}
ACLname
Parameters
-
standard
|
extended
- Specifies one of the following types of access lists:
- standard
- Contains rules that permit or deny traffic based on source addresses that you specify. The rules are applicable to all ports of the specified addresses.
- extended
- Contains rules that permit or deny traffic according to source and destination addresses, as well as other parameters. For example, you can also filter by port, protocol (TCP or UDP), and TCP flags.
-
ACLname
- Specifies an ACL name unique among all ACLs (Layer 2 and Layer 3). The name can be up to 63 characters in length, and must begin with an alphanumeric character. No special characters are allowed, except for the underscore and hyphen.
Modes
Global configuration mode
Usage Guidelines
An ACL name can be up to 63 characters long, and must begin with a–z, A–Z or 0–9. You can also use underscore (_) or hyphen (-) in an ACL name, but not as the first character.
After you create an ACL, use the
seq command to create filtering rules for that ACL.
An ACL starts functioning only
after:
- Applied to an interface, using the { ip | ipv6 | mac }
access-group command.
- Applied at device-level, using the { ip | ipv6 } receive
access-group command.
To delete an ACL, use the
no access-list command. You can delete an ACL only after you first remove it from all interfaces to which it is applied, using the
no access-group command.
Examples
The following example creates an IPv4 standard ACL.
device# configure
device(config)# ip access-list standard stdACL3
The following example creates an IPv4 extended
ACL.
device# configure terminal
device(config)# ip access-list extended extdACL5
The following example creates rules on an IPv4
standard ACL.
device# configure terminal
device(config)# ip access-list standard stdACL3
device(config-ipacl-std)# seq 5 permit host 10.20.33.4
device(config-ipacl-std)# seq 15 deny any
The following example deletes an IPv4 ACL.
device# configure
device(config)# no ip access-list standard stdACL3
