Cisco ASA Series Cli Configuration Manual page 564

Configuring Extended ACLs
Adding an ACE for TCP or UDP-Based Policy, with Ports
This section lets you control traffic based on IP addresses or fully qualified domain names (FQDNs)
along with TCP or UDP ports. An ACL is made up of one or more access control entries (ACEs) with
the same ACL ID. To create an ACL you start by creating an ACE and applying a list name. An ACL
with one entry is still considered a list, although you can add multiple entries to the list.
Prerequisites
•
•
Guidelines
To delete an ACE, enter the no access-list command with the entire command syntax string as it appears
in the configuration. To remove the entire ACL, use the clear configure access-list command.
Detailed Steps
Command
access-list access_list_name [line
line_number] extended {deny | permit}
{tcp | udp} source_address_argument
[port_argument] dest_address_argument
[port_argument] [log [[level]
[interval secs] | disable | default]]
[inactive | time-range time_range_name]
Example:
hostname(config)# access-list ACL_IN
extended deny tcp any host 209.165.201.29
eq www
Cisco ASA Series CLI Configuration Guide
1-6
(Optional) Create network objects or object groups according to the
and Groups" section on page
FQDN. Object groups contain multiple objects or inline entries.
(Optional) Create service objects or groups according to the
Service Groups" section on page
Purpose
Adds an ACE for IP address or FQDN policy, as well as optional TCP or
UDP ports. For common keywords and arguments, see the
for IP Address or Fully Qualified Domain Name-Based Policy" section on
page
following:
port_argument specifies the source and/or destination port. Available
arguments include:
•
•
Chapter 1
1-2. Objects can contain an IP address (host, subnet, or range) or an
1-5.
1-4. Keywords and arguments specific to this type of ACE include the
operator port—The operator can be one of the following:
–
lt—less than
–
gt—greater than
–
eq—equal to
–
neq—not equal to
–
range—an inclusive range of values. When you use this operator,
specify two port numbers, for example:
range 100 200
The port can be the integer or name of a TCP or UDP port. DNS,
Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one
definition for TCP and one for UDP. TACACS+ requires one definition
for port 49 on TCP.
object-group service_grp_id—Specifies a service object group
created using the object-group service command.
Adding an Extended Access Control List
"Configuring Network Objects
"Configuring Service Objects and
"Adding an ACE