permit icmp

To configure the ICMP (Internet Control Message Protocol) packets to be forwarded based on the associated parameters, use the command permit icmp in Extended ACL IP Configuration Mode.

permit

permit { icmp }
{ {any } { | host } { <src-ip-address>} } { | <src-ip-address>} } { <src-mask>} }
{ {any } { | host } { <dest-ip-address>} } { | <dest-ip-address>} } { <dest-mask>} }
{ [message-type } { <short (0-255)>] } { [message-code } { <short (0-255)>] } { {priority } { <value (1-255)>}] }
{ [svlan-id } { <vlan-id (1-4094)>] } { [svlan-priority } { <value (0-7)>] } { [cvlan-id } { <vlan-id (1-4094)>] } { [cvlan-priority } { <value (0-7)>] }
{ [{single-tag } { | double-tag}] }
{ [redirect } { {interface } { <iftype> } { <ifnum> } { | <iftype> } { <iface_list> } { [<iftype> } { <iface_list>] }
{ load-balance } { {src-ip } { | dst-ip } { | src-mac } { | dst-mac } { | vlanid } { | src-tcpport } { | dst-tcpport } { | src-udpport } { | dst-udpport}}] }
{ [sub-action } { {none } { | modify-vlan } { <short (1-4094)> } { | nested-vlan } { <short (1 -4094)>] }

Parameters

Parameter Type Description
icmp   Enter to specify the ICMP (Internet Control Message Protocol) to be forwarded based on the associated parameters.
any   Enter to specify that ICMP packets can be forwarded from any source.
host   Enter to specify the host source IPv4 address to be used for forwarding the packets.
Note:

Both source and destination port cannot be configured. Only either source or the destination port range can be configured.
<src-ip-address>   Enter a value for the host source IPv4 address to be used for forwarding the packets.
<src-mask>   Enter to specify the address of the host that the packet is destined for and the network mask to use with the destination IP address.
any   Enter to specify that ICMP packets can be forwarded to any destination.
host   Enter to specify the host destination IPv4 address to be used for forwarding the packets.
Note:

Both source and destination port cannot be configured. Only either source or the destination port range can be configured.
<dest-ip-address>   Enter a value for the host destination IPv4 address to be used for forwarding the packets.
<dest-mask>   Enter to specify the address of the host that the packet is destined for and the network mask to use with the destination IP address.
message-type   Enter to configure the ICMP Message type to be checked against the packet. The packet is allowed if it matches with the message type.
<short (0-255)> Integer Enter a ICMP Message type. This value ranges from 0 to 255. Some of the ICMP message types are:
  • Value ICMP Message type
  • 0 Echo reply
  • 3 Destination unreachable
  • 4 Source quench
  • 5 Redirect
  • 8 Echo request
  • 11 Time exceeded
  • 12 Parameter problem
  • 13 Timestamp request
  • 14 Timestamp reply
  • 15 Information request
  • 16 Information reply
  • 17 Address mask request
  • 18 Address mask reply
  • 55 No ICMP type
message-code   Enter to configure the ICMP Message code to be checked against the packet. The packet is allowed if it matches with the message type.
<short (0-255)> Integer Enter a ICMP Message code. This value ranges from 0 to 255. Some of the ICMP message Codes are:
  • Value ICMP code
  • 0 Network unreachable
  • 1 Host unreachable
  • 2 Protocol unreachable
  • 3 Port unreachable
  • 4 Fragment needed
  • 5 Source route fail
  • 6 Destination network unknown
  • 7 Destination host unknown8 Source host isolated
  • 9 Destination network administratively prohibited
  • 10 Destination host administratively prohibited
  • 11 Network unreachable TOS
  • 12 Host unreachable TOS
  • 255 No ICMP code
priority   Enter to configure the priority of the filter to decide which filter rule is applicable when the packet matches with more than one filter rules. Higher value of ‘filter priority’ implies a higher priority.
<short (1-255)> Integer Enter a priority value. This value ranges from 1 to 255.
svlan-id   Enter to configure Service VLAN value to match against incoming packets.
<vlan-id (1-4094)> Integer Enter a value for Service VLAN. This value ranges from 1 to 4094.
svlan-priority   Enter to specify Service VLAN related configuration.
<value (0-7)> Integer Enter a Service VLAN ID value. This value ranges from 0 to 7.
cvlan-id   Enter to configure Customer VLAN value to match against incoming packets.
<vlan-id (1-4094)> Integer Enter a value for Customer VLAN value to match against incoming packets.
cvlan-priority   Enter to configure Customer VLAN priority value to match against incoming packets.
<value (0-7)>   Enter a customer vlan ID value. This value ranges from 0 to 7.
double-tag   Enter to specify that the filter is to be applied on double VLAN tagged packets
single-tag   Enter to specify that the filter is to be applied on Single VLAN tagged packets
redirect   Enter to redirect the action to the destination interface or set of interfaces.
<iftype>   Enter destination interface type.The interface can be:
  • fastethernet – Officially referred to as 100BASE-T standard. This is a version of LAN standard architecture that supports data transfer up to 100 Megabits per second.
  • gigabitethernet – A version of LAN standard architecture that supports data transfer up to 1 Gigabit per second.
  • extreme-ethernet – A version of Ethernet that supports data transfer up to 10 Gigabits per second. This Ethernet supports only full duplex links
<ifnum>   Enter to redirect the packets to the specified interface identifier. This is a unique value that represents the specific interface. This value is a combination of slot number and port number separated by a slash, for interface types Gigabitethernet, Fastethernet and Extreme-Ethernet.
<iface_list>   Enter to redirect the packets to the list of interfaces.
load-balance   Enter to specify the parameters based on which the traffic distribution needs to be done.
src-ip   Enter to specify that the traffic distribution is based on the source IP address.
dst-ip   Enter to specify that the traffic distribution is based on the destination IP address.
src-mac   Enter to specify that the traffic distribution is based on the source MAC address.
dst-mac   Enter to specify that the traffic distribution is based on the destination MAC address.
vlanid   Enter to specify that the traffic distribution is based on the VLAN ID to be filtered.
src-tcpport   Enter to specify that the traffic distribution is based on the source TCP port number.
dst-tcpport   Enter to specify that the traffic distribution is based on the destination TCP Port number.
src-udpport   Enter to specify that the traffic distribution is based on the source UDP port number
dst-udpport   Enter to specify that the traffic distribution is based on the destination UDP port number.
sub-action   Enter to configure the VLAN specific sub action to be performed on the packet.
none   Enter to specify that the actions related to the VLAN ID will not be considered.
modify-vlan   Enter to specify to modify the VLAN ID to which the packet gets classified. The packet could be an untagged or VLAN tagged packet.
<short (1-4094)> Integer Enter a value for the VLAN ID to which the packet gets classified. This value ranges from 1 to 4094.
nested-vlan   Enter to specify to add an outer VLAN tag to the packet with the specified VLAN ID (nested VLAN).
<short (1-4094)> Integer Enter a value for the outer VLAN tag to the packet with the specified VLAN ID. This value ranges from 1 to 4094.

Mode

Extended ACL IP Configuration Mode

Default

Examples

iS5Comm (config)# ip access-list extended 1001

iS5Comm (config-ext-nacl)# permit icmp any 14.0.0.0 255.0.0.0 message-type 0 message-code 18 priority 22 svlan-id 2 svlan-priority 2 cvlan-id 2 cvlan-priority 2 double-tag redirect interface gigabitethernet 0/10 sub-action none

iS5Comm (config-ext-nacl)#

Parent topic: ACL