An ACL port operator is a Cisco IOS argument that compares TCP or UDP port numbers in an extended access-control entry (ACE). Operators narrow matching beyond protocol and IP addresses. section 24.1.2
Use these operators in the source- or destination-port position:
- eq 80 matches only port 80; gt 80 matches ports above 80; lt 80 matches ports below 80; neq 80 matches every port except 80; range 80 100 includes both endpoints. section 24.4
- An ACE may specify a source port, destination port, both, or neither. Omitted ports match all ports, and every specified ACE condition must match. section 24.1.2
- Filter client access to a service by its destination port: eq 443 matches HTTPS traffic, while eq 123 matches NTP traffic. section 24.4
HTTPS and NTP filtering
permit tcp 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 eq 443 permits HTTPS from one network to another. permit udp any host 192.168.4.19 eq 123 permits NTP to one host; Cisco IOS may display port 123 as ntp. section 24.1.2
Table 24.2 Example ACEs including port numbers (view table figure)
| ACE |
Explanation |
|---|---|
| permit tcp 10.0.0.0 0.0.0.255 any eq 443 |
Allows hosts in 10.0.0.0/24 to access all web servers using HTTPS (port 443) |
| deny udp any gt 50000 host 203.0.113.1 |
Prevents all hosts with a UDP source port greater than 50000 from accessing 203.0.113.1 |
| permit tcp 10.0.0.0 0.0.0.255 gt 9999 host 203.0.113.1 neq 23 |
Allows hosts in 10.0.0.0/24 with a TCP source port greater than 9,999 to access all TCP ports on 203.0.113.1 except port 23 |
| deny tcp any lt 1024 any gt 1023 |
Denies all TCP messages with a source port lower than 1,024 and a destination port greater than 1,023 |
Compare ACE examples that combine operators with source and destination addresses and ports. section 24.1.2
