cancel
Showing results for 
Search instead for 
Did you mean: 

7100-Series / ACL / Access Control List / Limitations

7100-Series / ACL / Access Control List / Limitations

networks
New Contributor
We want to transfer a large ACL from a DFE module (with Advanced Licence) to an 7100 (about 300 entries). We can only enter 171 lines, then we're done.

The "show limits" command displays:

Chassis limits:
Application Limit In use Entry size Total Memory
-------------------------------- --------- --------- ------------ ------------
access-lists 256 9 125K 31.3M
access-list-entries 1000 171 160B 156.4K
access-list-entries-per-list 1000 - - -
applied-access-lists 1552 0 110B 165.5K
applied-ipv4-in 256 0 - -
applied-ipv4-out 256 0 - -
applied-ipv6-in 256 0 - -
applied-ipv6-out 256 0 - -
applied-l2-in 256 0 - -
applied-l2-out 256 0 - -

The "show limits resource-profile -verbose" command displays:

Resource Profile: router1
Authenticated Users = 512
MAC Rules = 0
IPV6 Rules = 0
IPV4 Rules = 249
L2 Rules = 175
IPV6 Ingress ACL = 128
IPV6 PBR = 0
IPV4 Ingress ACL = 128
IPV4 PBR = 128
L2 Ingress ACL = 0
IPV6 Egress ACL = 256
IPV4 Egress ACL = 256
L2 Egress ACL = 0

How can we solve the problem (more accepted entries in the ACL)?
26 REPLIES 26

networks
New Contributor
THANKS A LOT to all!

Careno__Ryan
Extreme Employee
You may want to double check and/or test this, but here's a shortened ACL (116 lines):

permit ip host 192.168.1.248 any permit ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.1.255
permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.1.255
permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.1.255
permit ip 192.168.1.0 0.0.0.255 192.168.12.0 0.0.1.255
permit ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
permit ip 192.168.1.240 0.0.0.7 host 192.168.200.201
permit ip 192.168.60.0 0.0.3.255 192.168.60.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.2.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.2.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.4.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.4.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.10.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.10.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 192.168.10.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 25 192.168.10.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.12.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.12.0 0.0.1.255
permit tcp 192.168.200.0 0.0.0.255 192.168.12.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 192.168.13.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 25 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.50.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 192.168.50.0 0.0.0.255 eq 10051
permit tcp 192.168.200.0 0.0.0.255 eq 10050 192.168.50.0 0.0.0.255
permit tcp 192.168.16.0 0.0.0.255 host 192.168.50.202 eq 1521
permit tcp 192.168.16.0 0.0.0.255 host 192.168.50.208 eq 1521
permit tcp 192.168.88.0 0.0.0.255 host 192.168.50.208 eq 1521
permit ip 192.168.86.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 9100
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 80
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 443
permit ip 192.168.5.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.5.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 164.26.201.248 0.0.0.7 192.168.2.0 0.0.0.255
permit tcp 10.240.10.0 0.0.0.255 host 192.168.50.202 eq 22
permit ip 192.168.10.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.2.0 0.0.1.255
permit ip 192.168.10.0 0.0.0.255 192.168.4.0 0.0.1.255
permit ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.10.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.10.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.2.0 0.0.1.255
permit ip 192.168.11.0 0.0.0.255 192.168.4.0 0.0.1.255
permit ip 192.168.11.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.11.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.11.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.12.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.12.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.2.0 0.0.1.255
permit ip 192.168.13.0 0.0.0.255 192.168.4.0 0.0.1.255
permit ip 192.168.13.0 0.0.0.255 192.168.10.0 0.0.1.255
permit ip 192.168.13.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.13.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.13.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.66.0 0.0.0.255 192.168.65.0 0.0.0.255
permit tcp 192.168.84.0 0.0.0.255 host 192.168.50.20 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.91.0 0.0.0.255 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.92.0 0.0.1.255 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.91.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.92.0 0.0.1.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.90.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.90.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit tcp 192.168.91.0 0.0.0.255 eq 3389 any
permit tcp 192.168.92.0 0.0.0.255 eq 3389 any
permit tcp 192.168.97.0 0.0.0.255 eq 3389 any
permit tcp any eq 80 host 192.168.2.11
permit tcp any eq 443 host 192.168.2.11
permit tcp any eq 80 host 192.168.2.19
permit tcp any eq 3101 host 192.168.50.201
permit tcp any eq 443 host 192.168.50.201
permit tcp any eq 3101 host 192.168.50.229
permit tcp any eq 443 host 192.168.50.229
permit tcp any eq 443 host 192.168.50.238
permit tcp any eq 2222 host 192.168.60.254
permit ip host 192.168.200.201 192.168.1.240 0.0.0.7
permit ip host 192.168.200.201 host 192.168.1.249
permit ip host 192.168.200.201 host 192.168.1.252
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 22
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 80
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 3389
permit tcp host 192.168.200.201 192.168.97.0 0.0.0.255 eq 3389
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 636
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 636
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 7191
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 7191
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 4500
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 4500
permit ip host 192.168.14.13 host 192.168.50.215
permit ip 10.22.96.0 0.0.0.255 192.168.2.0 0.0.0.255
permit tcp 10.240.10.0 0.0.0.255 host 192.168.50.202 eq 5714
permit tcp 10.240.10.0 0.0.255.255 host 192.168.50.212 eq 1158
permit tcp 10.240.10.0 0.0.255.255 host 192.168.50.212 eq 5502
permit ip 10.12.7.0 0.0.0.255 192.168.50.0 0.0.0.255
permit ip 10.12.6.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.1.0 0.0.0.255 eq 123 192.168.60.0 0.0.3.255
permit udp 192.168.1.0 0.0.0.255 eq 123 192.168.60.0 0.0.3.255
deny ip any any

Ryan

Erik_Auerswald
Contributor II
Hi Andre,

you can combine some of the lines by using a different wildcard mask. An example would be:

The two lines
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 can be combined into
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.1.255 Br,
Erik

Great to see you back on the Hub Erik!

networks
New Contributor
Is there any chance to consolidating these rules:

ip access-list extended 101 permit ip host 192.168.1.248 any
permit ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.12.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
permit ip 192.168.1.240 0.0.0.7 host 192.168.200.201
permit ip 192.168.60.0 0.0.3.255 192.168.60.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.2.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.2.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.3.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.3.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.4.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.4.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.5.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.5.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.10.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.10.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.10.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 25 192.168.10.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.11.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.11.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 25 192.168.11.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.12.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.12.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.12.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.13.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.13.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.13.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 eq 80 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 443 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 eq 25 192.168.50.0 0.0.0.255
permit tcp 192.168.200.0 0.0.0.255 192.168.50.0 0.0.0.255 eq 25
permit tcp 192.168.200.0 0.0.0.255 192.168.50.0 0.0.0.255 eq 10051
permit tcp 192.168.200.0 0.0.0.255 eq 10050 192.168.50.0 0.0.0.255
permit tcp 192.168.16.0 0.0.0.255 host 192.168.50.202 eq 1521
permit tcp 192.168.16.0 0.0.0.255 host 192.168.50.208 eq 1521
permit tcp 192.168.88.0 0.0.0.255 host 192.168.50.208 eq 1521
permit ip 192.168.86.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 9100
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 80
permit tcp 192.168.5.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 443
permit ip 192.168.5.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.5.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.5.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 164.26.201.248 0.0.0.7 192.168.2.0 0.0.0.255
permit tcp 10.240.10.0 0.0.0.255 host 192.168.50.202 eq 22
permit ip 192.168.10.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.4.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.5.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.10.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.10.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.4.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.5.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.11.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.11.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.11.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.13.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.12.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.12.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.4.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.5.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.11.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.13.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.13.0 0.0.0.255 192.168.200.0 0.0.0.255
permit ip 192.168.66.0 0.0.0.255 192.168.65.0 0.0.0.255
permit tcp 192.168.84.0 0.0.0.255 host 192.168.50.20 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.91.0 0.0.0.255 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.92.0 0.0.0.255 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.93.0 0.0.0.255 eq 3389
permit tcp 192.168.85.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.91.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.92.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.93.0 0.0.0.255 eq 3389
permit tcp 192.168.88.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit ip 192.168.90.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.90.0 0.0.0.255 192.168.97.0 0.0.0.255 eq 3389
permit tcp 192.168.91.0 0.0.0.255 eq 3389 any
permit tcp 192.168.92.0 0.0.0.255 eq 3389 any
permit tcp 192.168.97.0 0.0.0.255 eq 3389 any
permit tcp any eq 80 host 192.168.2.11
permit tcp any eq 443 host 192.168.2.11
permit tcp any eq 80 host 192.168.2.19
permit tcp any eq 3101 host 192.168.50.201
permit tcp any eq 443 host 192.168.50.201
permit tcp any eq 3101 host 192.168.50.229
permit tcp any eq 443 host 192.168.50.229
permit tcp any eq 443 host 192.168.50.238
permit tcp any eq 2222 host 192.168.60.254
permit ip host 192.168.200.201 192.168.1.240 0.0.0.7
permit ip host 192.168.200.201 host 192.168.1.249
permit ip host 192.168.200.201 host 192.168.1.252
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 22
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 80
permit tcp host 192.168.200.201 192.168.50.0 0.0.0.255 eq 3389
permit tcp host 192.168.200.201 192.168.97.0 0.0.0.255 eq 3389
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 636
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 636
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 7191
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 7191
permit tcp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 4500
permit udp host 192.168.200.207 192.168.50.0 0.0.0.255 eq 4500
permit ip host 192.168.14.13 host 192.168.50.215
permit ip 10.22.96.0 0.0.0.255 192.168.2.0 0.0.0.255
permit tcp 10.240.10.0 0.0.0.255 host 192.168.50.202 eq 5714
permit tcp 10.240.10.0 0.0.255.255 host 192.168.50.212 eq 1158
permit tcp 10.240.10.0 0.0.255.255 host 192.168.50.212 eq 5502
permit ip 10.12.7.0 0.0.0.255 192.168.50.0 0.0.0.255
permit ip 10.12.6.0 0.0.0.255 192.168.50.0 0.0.0.255
permit tcp 192.168.1.0 0.0.0.255 eq 123 192.168.60.0 0.0.3.255
permit udp 192.168.1.0 0.0.0.255 eq 123 192.168.60.0 0.0.3.255
deny ip any any
GTM-P2G8KFN