Time Range Applied To An Ip Acl; Commented Ip Acl Entries - Cisco Catalyst 3750 Software Configuration Manual

Metro switch

Hide thumbs Also See for Catalyst 3750:

Table of Contents

Configuring Network Security with ACLs

Time Range Applied to an IP ACL

This example denies HTTP traffic on IP on Monday through Friday between the hours of 8:00 a.m. and

6:00 p.m (18:00). The example allows UDP traffic only on Saturday and Sunday from noon to 8:00 p.m.

Switch(config)# time-range no-http

Switch(config)# periodic weekdays 8:00 to 18:00

Switch(config)# time-range udp-yes

Switch(config)# periodic weekend 12:00 to 20:00

Switch(config)# ip access-list extended strict

Switch(config-ext-nacl)# deny tcp any any eq www time-range no-http

Switch(config-ext-nacl)# permit udp any any time-range udp-yes

Switch(config-ext-nacl)# exit

Switch(config)# interface fastethernet1/0/1

Switch(config-if)# ip access-group strict in

In this example of a numbered ACL, the workstation belonging to Jones is allowed access, and the

workstation belonging to Smith is not allowed access:

Switch(config)# access-list 1 remark Permit only Jones workstation through

Switch(config)# access-list 1 permit 171.69.2.88

Switch(config)# access-list 1 remark Do not allow Smith workstation through

Switch(config)# access-list 1 deny 171.69.3.13

In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the

Switch(config)# access-list 100 remark Do not allow Winter to browse the web

Switch(config)# access-list 100 deny host 171.69.3.85 any eq www

Switch(config)# access-list 100 remark Do not allow Smith to browse the web

Switch(config)# access-list 100 deny host 171.69.3.13 any eq www

In this example of a named ACL, the Jones subnet is not allowed access:

Switch(config)# ip access-list standard prevention

Switch(config-std-nacl)# remark Do not allow Jones subnet through

Switch(config-std-nacl)# deny 171.69.0.0 0.0.255.255

In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet:

Switch(config)# ip access-list extended telnetting

Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out

Switch(config-ext-nacl)# deny tcp 171.69.0.0 0.0.255.255 any eq telnet

Catalyst 3750 Metro Switch Software Configuration Guide

Configuring IP ACLs