Access-List ICMP  	Description
command	
parameter	

access-list number	A number from 100 to 199
permit/deny	Whether this entry is used to 
		allow or block the specified 
		address(es)

source and 	IP addresses
destination

source-wildcard  	Wildcard masks of address bits
and destination	that must match 
-wildcard				

icmp-type		Packets can be filtered by ICMP 
		message type. The type is a 
		number from 0 to 255.

icmp-code		Packets that have been filtered 
		by ICMP message type can also be 
		filtered by ICMP message code. 
		The code is a number from 0 to 255.
		
icmp-message	Packets can be filtered by a 
		symbolic name representing an 
		ICMP message type or a 
		combination of ICMP message type 
		and ICMP message code. 


The following is a list of ICMP message type names and ICMP message type and code names:

	administratively-prohibited

	alternate-address

	conversion-error

	dod-host-prohibited

	dod-net-prohibited

	echo

	echo-reply

	general-parameter-problem

	host-isolated

	host-precedence-unreachable

	host-redirect

	host-tos-redirect

	host-tos-unreachable

	host-unknown

	host-unreachable

	information-reply

	information-request

	mask-reply

	mask-request

	mobile-redirect

	net-redirect

	net-tos-redirect

	net-tos-unreachable

	net-unreachable

	network-unknown

	no-room-for-option

	option-missing

	packet-too-big

	parameter-problem

	port-unreachable

	precedence-unreachable

	protocol-unreachable

	reassembly-timeout

	redirect

	router-advertisement

	router-solicitation

	source-quench

	source-route-failed

	time-exceeded

	timestamp-reply

	timestamp-request

	traceroute

	ttl-exceeded

	unreachable
@@ 2
Access-List TCP	    Description
command parameter	

access-list number	    A number from 100 to 199

permit/deny	    Whether this entry is used to 
		    allow or block the specified 
		    address(es)

source and 	    IP addresses
destination

source-wildcard 	Wildcard masks of address bits 
and destination	that must match
-wildcard
			
source port and	A decimal number between 0 and 
destination port	65535 or a name that represents 
		a TCP port number

operator		A qualifying condition. It can 
		be: lt (less than), gt (greater 
		than), eq (equal to), neq (not 
		equal to), and range (inclusive 
		range)

established	A match occurs if the TCP 
		datagram has the ACK or RST bits 
		set. So the first packet 
		arriving is passed on down the 
		list, until it is ultimately 
		permitted or denied. If it is 
		permitted, subsequent packets 
		belonging to the now established 
		connection are permitted by this 
		first line and need no further 
		processing.

precedence	Packets can be filtered by 
		precedence level specified by a 
		number from 0 to 7

tos		Packets can be filtered by type 
		of service level specified by a 
		number from 0 to 15
@@ 3
Access-list 	Description
UDP 

access-list number	A number from 100 to 199

permit/deny	Whether this entry is used to 
		allow or block the specified 
		address(es)

source and 	IP addresses
destination

source-wildcard  	Wildcard masks of address bits
and destination-	that must match 
wildcard

source port and 	A decimal number between 0 and 
destination port	65535 or a name that represents 
		a TCP port number

operator		A qualifying condition. It can 
		be: lt (less than), gt (greater 
		than), eq (equal to), neq (not 
		equal to), and range (inclusive 
		range)

established	A match occurs if the TCP 
		datagram has the ACK or RST bits 
		set

precedence	Packets can be filtered by 
		precedence level specified by a 
		number from 0 to 7

tos		Packets can be filtered by type 
		of service level specified by a 
		number from 0 to 15
@@ 4
The fact that the router will only accept particular types 
of connection on specified ports makes it possible to 
separately control incoming and outgoing services. The 
access list can be configured on either the inbound or the 
outbound interface.

For example, SMTP uses TCP port 25 on one end of the 
connection and a random port number on the other end. 
The same two port numbers are used throughout the life 
of the connection.

Mail packets coming in from the Internet will have a 
destination port of 25. Outbound packets will have the 
port numbers reversed.
@@
