Cisco Catalyst 2960-XR Security Configuration Manual page 149
Ios release 15.0 2 ex1
Hide thumbs
Also See for Catalyst 2960-XR:
- Configuration manual (196 pages) ,
- Configuration manuals (120 pages) ,
- Reference (52 pages)
Table of Contents
Advertisement
Configuring IPv4 ACLs
DETAILED STEPS
Command or Action
Step 1
configure terminal
Example:
Switch# configure terminal
Step 2
ip access-list extended name
Example:
Switch(config)# ip access-list extended 150
Step 3
{deny | permit} protocol {source [source-wildcard]
| host source | any} {destination
[destination-wildcard] | host destination | any}
[precedence precedence] [tos tos] [established] [log]
[time-range time-range-name]
Example:
Switch(config-ext-nacl)# permit 0 any any
Step 4
end
Example:
Switch(config-ext-nacl)# end
When you are creating extended ACLs, remember that, by default, the end of the ACL contains an implicit
deny statement for everything if it did not find a match before reaching the end. For standard ACLs, if you
omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask.
After you create an ACL, any additions are placed at the end of the list. You cannot selectively add ACL
entries to a specific ACL. However, you can use no permit and no deny access-list configuration mode
commands to remove entries from a named ACL. This example shows how you can delete individual ACEs
from the named access list border-list:
Switch(config)# ip access-list extended border-list
Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any
Being able to selectively remove lines from a named ACL is one reason you might use named ACLs instead
of numbered ACLs.
OL-29434-01
Purpose
Enters the global configuration mode.
Defines an extended IPv4 access list using a name, and enter
access-list configuration mode.
The name can be a number from 100 to 199.
In access-list configuration mode, specify the conditions allowed
or denied. Use the log keyword to get access list logging
messages, including violations.
• host source—A source and source wildcard of source
0.0.0.0.
• host destintation—A destination and destination wildcard
of destination 0.0.0.0.
• any—A source and source wildcard or destination and
destination wildcard of 0.0.0.0 255.255.255.255.
Returns to privileged EXEC mode.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Creating Extended Named ACLs
127
Advertisement
Table of Contents
