Cisco Catalyst 2950 Software Manual page 301

Chapter 12 Configuring Network Security with ACLs
This example uses an extended ACL to deny traffic from port 80 (HTTP). It permits all other types of
traffic.
Switch(config)# access-list 106 deny tcp any any eq 80
Switch(config)# access-list 106 permit ip any any
Switch(config)# interface gigabitethernet0/2
Switch(config-if)# ip access-group 106 in
Numbered ACL Examples
This example shows that the switch accepts addresses on network 36.0.0.0 subnets and denies all packets
coming from 56.0.0.0 subnets. The ACL is then applied to packets entering Gigabit Ethernet interface
0/1.
Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255
Switch(config)# access-list 2 deny 56.0.0.0 0.255.255.255
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 2 in
Extended ACL Examples
In this example of using an extended ACL, you have a network connected to the Internet, and you want
any host on the network to be able to form TCP Telnet and SMTP connections to any host on the Internet.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 23
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 25
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 102 in
SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The
same port numbers are used throughout the life of the connection. Mail packets coming in from the
Internet have a destination port of 25. Because the secure system behind the switch always accepts mail
connections on port 25, the incoming services are controlled.
Named ACL Example
The Marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard
171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits any other IP traffic.
Switch(config)# ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit ip any any
The ACLs are applied to permit Gigabit Ethernet port 0/1, which is configured as a Layer 2 port, with
the Marketing_group ACL applied to incoming traffic.
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group marketing_group in
...
78-11380-03
Catalyst 2950 Desktop Switch Software Configuration Guide
Configuring ACLs
12-19