Configuring a connection-rate ACL using UDP/TCP criteria

Syntax
ip access-list connection-rate-filter crf-list-name
Creates a connection-rate-filter ACL and puts the CLI into the ACE context.
switch(config-crf-nacl)#

If the ACL already exists, this command simply puts the CLI into the ACE context.

Syntax
< filter | ignore | < udp | tcp > < any >
< filter | ignore | < udp | tcp > < host ip-addr > [ udp/tcp-options ]
< filter | ignore | < udp | tcp > ip-addr mask-length [ udp/tcp-options ]

Used in the ACE context (above) to specify the action of the connection-rate ACE (filter or ignore), and the UDP/TCP criteria and SA of the IP traffic that the ACE affects.

< filter | ignore >

filter

This option assigns a policy of filtering (dropping) IP traffic having an SA that matches the source address criteria in the ACE.

ignore

This option specifies a policy of allowing IP traffic having an SA that matches the source address criteria in the ACE.

< udp | tcp > < any | host > ip-addr | ip-addr mask-length
 

Applies the filter or ignore action to either TCP packets or UDP packets having the specified SA.

any

Applies the ACEs action (filter or ignore) to IP traffic having any SA.

host <ip-addr>

Applies the ACEs action (filter or ignore) to IP traffic having the specified host SA.

ip-addr <mask-length>

Applies the ACEs action (filter or ignore) to IP traffic having an SA within the range defined by either:

<src-ip-addr/cidr-mask-bits>

or

<src-ip-addr <mask>>

Use this criterion for traffic received from either a subnet or a group of IP addresses. The mask can be in either dotted-decimal format or CIDR format with the number of significant bits.

[udp/tcp-options]

destination-port <tcp-data> [ source-port <tcp-data> ]
    
source-port <tcp-data> [ destination-port <tcp-data> ]
    
destination-port <udp-data> [ source-port <udp-data> ]
    
source-port <udp-data> [ destination-port <udp-data> ]
    

tcp-data: operator tcp-port-#

udp-data: operator udp-port-#

operator < eq | gt | lt | neq | range >
eq <port-nbr-or-name>
 

"Equal To": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be equal to the specified port number.

gt <port-nbr-or-name>
    

"Greater Than": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be greater than the specified port number.

lt <port-nbr-or-name>
    

"Less Than": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be less than the specified port number.

neq <port-nbr-or-name>
    

"Not Equal": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must not be equal to the specified port number.

range <start-port-nbr/name> <end-port-nbr/name>
    

To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be in the range <start-port-nbr/name> <end-port-nbr/name>.

tcp-data or udp-data

TCP or UDP Port Number or (Well-Known) Port Name:

Use the TCP or UDP port number required for the desired match. The switch also accepts certain well-known TCP or UDP port names as alternates to their corresponding port numbers:

TCP/UDP-PORT:

Specify port by number.

bootpc

Bootstrap Protocol, client (68)

bootps

Bootstrap Protocol, server (67)

dns

Domain Name Service (53)

ntp

Network Time Protocol (123)

radius

Remote Authentication Dial-In User Service (1812)

radius-old

Remote Authentication Dial-In User Service (1645)

rip

Routing Information Protocol (520)

snmp

Simple Network Management Protocol (161)

snmp-trap

Simple Network Management Protocol (162)

tftp

Trivial File Transfer Protocol (69)

Examples of connection-rate ACEs using UDP/TCP criteria