Ip Access-Group - Cisco MDS 9124 - Fabric Switch Reference

Chapter 11 I Commands
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

ip access-group

To apply an access list to an interface, use the ip access-group command in interface mode. Use the no
form of this command to negate a previously issued command or revert to factory defaults.
Syntax Description access-list-name
in
out
Defaults
The access list is applied to both ingress and egress traffic.
Command Modes Interface mode.
Command History Release
1.2(1)
Usage Guidelines
The ip access-group command controls access to an interface. Each interface can only be associated
with one access list. The access group becomes active immediately.
We recommend creating all rules in an access list, before creating the access group that uses that access
list.
If you create an access group before an access list, the access list is created and all packets in that
interface are dropped, because the access list is empty.
The access-group configuration for the ingress traffic applies to both local and remote traffic. The
access-group configuration for the egress traffic applies only to local traffic. You can apply a different
access list for each type of traffic.
Examples The following example creates an access group called aclPermit for both the ingress and egress traffic
(default)
switch# config terminal
Enter configuration commands, one per line.
switch(config)# ip access-list aclPermit permit ip any any
switch(config)# interface Gigabitethernet 3/1
switch(config-if)# ip access-group aclPermit
The following example deletes the access group called aclPermit.
switch(config-if)# no ip access-group aclPermit
The following example creates an access group called aclDenyTcp (if it does not already exist) for
ingress traffic.
OL-16217-01, Cisco MDS SAN-OS Release 3.x
ip access-group access-list-name [in | out]
Specifies the IP access list name. The maximum length is 64 alphanumeric
characters and the text is case insensitive.
Specifies that the group is for ingress traffic.
Specifies that the group is for egress traffic.
Modification
This command was introduced.
End with CNTL/Z.
Cisco MDS 9000 Family Command Reference
ip access-group
11-41