Named Acls - Cisco Catalyst 3750 Software Configuration Manual

Chapter 25 Configuring Network Security with ACLs
Configuring IP ACLs
SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The
same port numbers are used throughout the life of the connection. Mail packets coming in from the
Internet have a destination port of 25. Outbound packets have the port numbers reversed. Because the
secure system of the network always accepts mail connections on port 25, the incoming and outgoing
services are separately controlled. The ACL must be configured as an input ACL on the outbound
interface and an output ACL on the inbound interface.
In this example, the network is a Class B network with the address 128.88.0.0, and the mail host address
is 128.88.1.2. The established keyword is used only for the TCP to show an established connection. A
match occurs if the TCP datagram has the ACK or RST bits set, which show that the packet belongs to
an existing connection. The specified interface is the interface that connects the router to the Internet.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established
Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# ip access-group 102 in

Named ACLs

This example creates a standard ACL named internet_filter and an extended ACL named
marketing_group. The internet_filter ACL allows all traffic from the source address 1.2.3.4.
Switch(config)# ip access-list standard Internet_filter
Switch(config-ext-nacl)# permit 1.2.3.4
Switch(config-ext-nacl)# exit
The marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard
171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits ICMP traffic, denies UDP traffic
from any source to the destination address range 171.69.0.0 through 179.69.255.255 with a destination
port less than 1024, denies any other IP traffic, and provides a log of the result.
Switch(config)# ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit icmp any any
Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt 1024
Switch(config-ext-nacl)# deny ip any any log
Switch(config-ext-nacl)# exit
The ACLs are applied to an interface, which is configured as a Layer 3 port, with the Internet_filter ACL
applied to outgoing traffic and the marketing_group ACL applied to incoming traffic.
Switch(config)# interface gigabitethernet1/0/2
Switch(config-if)# no switchport
Switch(config-if)# ip address 2.0.5.1 255.255.255.0
Switch(config-if)# ip access-group Internet_filter out
Switch(config-if)# ip access-group marketing_group in
Catalyst 3750 Metro Switch Software Configuration Guide
25-22
78-15870-01