Access List Commands
| Command |
Description |
| show access-lists |
Displays all access lists and their parameters configured on the
router. This command doesn't show which interface the list is configured on. |
| show access-list [list #] |
Shows only the parameters for the access list specified. This command does
not show you the interface the list is configured on. |
| show ip access-list |
Shows only the IP access lists configured on the router. |
| show ipx access-list |
Shows only the IPX access lists configured on the router. |
| show ip interface |
Shows which interfaces have IP access lists on them. |
| show ipx interface |
Shows which interfaces have IPX access lists on them. |
| show running-config |
Shows the access lists and which interfaces have access lists set. |
| any |
Keyword used to represent all hosts or networks, replaces 0.0.0.0
255.255.255.255 in access list. |
| host |
Keyword that specifies that an address should have a wildcard mask of
0.0.0.0 (i.e will match only 1 host) |
| clear access-list counter [list#] |
Clears extended access lists counter of the number of matches per line of
the access list. |
| -1 |
Applies to any IPX network or any protocol when used in extended IPX access
lists. |
| 0 |
Used for all sockets in extended IPX access lists. |
| ip access-group |
Applies an IP access list to an interface. |
| ipx access-group |
Applies an IPX access list to an interface. |
| ipx input-sap-filter |
Applies an inbound IPX SAP filter to an interface. |
| ipx output-sap-filter |
Applies an outbound IPX SAP filter to an interface. |
Access List Ranges
| Access List Type |
Number |
| Standard IP Access Lists |
1-99 |
| Extended IP Access Lists |
100-199 |
| Standard IPX Access Lists |
800-899 |
| Extended IPX Access Lists |
900-999 |
| IPX SAP Filters |
1000-1099 |
Standard Access List Syntax
IP
access-list 1-99 {permit|deny} address mask
| Variable |
Definition |
| 1-99 |
Standard IP access lists are represented by a number ranging from 1-99 or
text names with IOS 11.2 or greater. |
| {permit|deny} |
Used to specify the nature of the access list, either a permit or deny
statement. |
| address |
The IP address of the source. |
| mask |
A wildcard mask, or inverse mask, applied to determine which bits of source
address are significant. |
IPX
access-list 800-899 {deny|permit} source-network[.source-address[source-mask]]
destination-network[.destination-address[destination-mask]]
| Variable |
Definition |
| 800-899 |
Standard IPX access lists are represented by a number ranging from 800-899. |
| {deny|permit} |
Used to specify the nature of the access list either a permit or deny
statement. |
| source-network[.source-address[source-mask]] |
The IPX address of the source network or node. |
| destination-network[.destination-address[destination-mask]] |
The IPX address of the destination network or node. |
Extended Access List Syntax
IP
access-list 100-199 {permit|deny} {ip|tcp|udp|icmp} source source-mask [lt|gt|eq|neq]
[source-port] destination dest-mask [lt|gt|eq|neq] [dest-port] [log]
| Variable |
Definition |
| 100-199 |
Extended IP access lists are represented by a number ranging from 100-199 or
text names with IOS 11.2 or greater. |
| {permit|deny} |
Used to specify the nature of the access list either a permit or deny
statement. |
| {ip|tcp|udp|icmp} |
The IP protocol to be filtered can be IP (includes all protocols in the
TCP/IP suite) TCP,UDP,ICMP,or others. |
| source |
The IP address of the source |
| source-mask |
A wildcard mask, or inverse mask, applied to determine which bits of source
address are significant. |
| [lt|gt|eq|neq] |
Can contain lt (less than), gt (greater than), eq
(equal to), or neq (not equal to). It is used if an extended list filters
by a specific port number or range of ports. |
| [source-port] |
If necessary, the source port number of the protocol to be filtered. |
| destination |
The IP address of the destination |
| dest-mask |
A wildcard mask, or inverse mask, applied to determine which bits of
destination address are significant. |
| [lt|gt|eq|neq] |
Can contain lt (less than), gt (greater than), eq
(equal to), or neq (not equal to). It is used if an extended list filters
by a specific port number or range of ports. |
| [dest-port] |
If necessary, the destination port number of the protocol to be filtered. |
| [log] |
Turns on logging of access list activity. |
IPX
access-list 900-999 {deny|permit} protocol source-network.[source-address[source-mask]] socket
destination-network.[destination-address[dest-mask]] destination-socket
| Variable |
Definition |
| 900-999 |
Extended IPX access lists are represented by a number ranging from 900-999. |
| {deny|permit} |
Used to specify the nature of the access list either a permit or deny
statement. |
| protocol |
IPX protocol, a -1 specifies all IPX protocols. |
| source-network.[source-address[source-mask]] |
The IPX address of the source network or node. |
| socket |
Source socket similar to the port value in IP access lists, points to a
particular service, a 0 specifies all sockets. |
| destination-network.[destination-address[dest-mask]] |
The IPX address of the destination network or node. |
| socket |
Destination socket, similar to the port value in IP access lists, points to
a particular service, a 0 specifies all sockets. |
SAP Filters
SAP
access-list 1000-1099 {permit|deny} network.[address] [service-type]
| Variable |
Definition |
| 1000-1099 |
IPX SAP filters are represented by a number in the range of 1000-1099. |
| {permit|deny} |
Used to specify the nature of the access list either a permit or deny
statement. |
| network.[address] |
The IPX address of the source network or node. |
| [service-type] |
IPX services such as print services, file services, or directory services, a
0 is for all services. |
|