Enterasys Networks X-Pedition XSR CLI - Manual (Page 561)

IPSec Commands
XSR CLI Reference Guide 14-107
Syntax
access-list acl-number {deny | permit} protocol [source_addr source_mask [eq port]
destination_addr destination_mask [eq port]
Syntax of the “no” Form
The no form of this command removes the access list:
no access-list acl-number {deny | permit} protocol [source_addr source_mask [eq
port] destination_addr destination_mask [eq port]
Default
An extended ACL defaults to a list that denies everything.
Mode
Global configuration: XSR(config)#
Examples
The following example configures two IP ACLs:
XSR(config)#access-list 100 permit ip 0.0.0.0 255.255.255.255 192.168.1.0
XSR(config)#access-list 101 permit ip 0.0.0.0 255.255.255.255 host 10.123.234.45
The following ACLs secure L2TP:
XSR(config)#access-list 120 permit udp any eq 1701 any
XSR(config)#access-list 130 permit udp any any eq 1701
acl-number A uniquely defined access list number.
deny Prevents traffic from being protected by IPSec in the contextof a
particular crypto map entry: it does not allow the policy as set in
crypto map statements to be applied to this traffic.
permit Causes all IP traffic that matches the specified conditions to be
protected by IPSec using the policy described by the corresponding
crypto map command statements.
protocol Name or number of an IP protocol. It can be one of the keywords ip,
tcp, or udp, or an integer ranging from 1 to 254 representing an IP
protocol number. To match any Internet protocol, including TCP,
and UDP, use the keyword ip.
eq port A clause to define a matching source and/or destination port
number. Source and/or destination is defined by the location of the
eq keyword in the command. A port number of zero matches any
port. May only be used with TCP and UDP protocols.
source-addr Address of the network or host from which the packet is sent.
source-mask Netmask bits (mask) to be applied to source_addr.
destination-addr IP address of the network or host to where the packet is sent.
destination-mask Netmask bits (mask) to be applied to destination_addr.