Cisco Catalyst 3550 series Software Configuration Manual page 548

Configuring IP ACLs
Command
Step 4 show access-lists [number | name]
Step 5
copy running-config startup-config
Use the no access-list access-list-number global configuration command to delete the entire ACL. You
cannot delete individual ACEs from numbered access lists.
When creating an ACL, remember that, by default, the end of the ACL contains an implicit deny
Note
statement for all packets that it did not find a match for before reaching the end. With standard access
lists, if you omit the mask from an associated IP host address ACL specification, 0.0.0.0 is assumed to
be the mask.
This example shows how to create a standard ACL to deny access to IP host 171.69.198.102, permit
access to any others, and display the results.
Switch (config)# access-list 2 deny host 171.69.198.102
Switch (config)# access-list 2 permit any
Switch(config)# end
Switch# show access-lists
Standard IP access list 2
The switch always rewrites the order of standard access lists so that entries with host matches and entries
with matches having a don't care mask of 0.0.0.0 are moved to the top of the list, above any entries with
non-zero don't care masks. Therefore, in show command output and in the configuration file, the ACEs
do not necessarily appear in the order in which they were entered.
The switch software can provide logging messages about packets permitted or denied by a standard IP
access list. That is, any packet that matches the ACL causes an informational logging message about the
packet to be sent to the console. The level of messages logged to the console is controlled by the logging
console commands controlling the syslog messages.
Because routing is done in hardware and logging is done in software, if a large number of packets match
Note
a permit or deny ACE containing a log keyword, the software might not be able to match the hardware
processing rate, and not all packets will be logged.
The first packet that triggers the ACL causes a logging message right away, and subsequent packets are
collected over 5-minute intervals before they are displayed or logged. The logging message includes the
access list number, whether the packet was permitted or denied, the source IP address of the packet, and
the number of packets from that source permitted or denied in the prior 5-minute interval.
An output ACL cannot log multicast packets. Logging is not supported for ACLs applied to Layer 2
Note
interfaces.
After creating an ACL, you must apply it to a line or interface, as described in the
to an Interface or Terminal Line" section on page
Catalyst 3550 Multilayer Switch Software Configuration Guide
28-10
Purpose
Show the access list configuration.
(Optional) Save your entries in the configuration file.
deny 171.69.198.102
permit any
Chapter 28 Configuring Network Security with ACLs
28-19.
"Applying an IP ACL
78-11194-09