Cisco 4700M Configuration Manual page 65

Chapter 1 Configuring Security Access Control Lists
If you perform NAT on both interfaces, you must verify the addresses that are
visible on each interface when you create and apply ACLs. In
outside server uses static NAT so that a translated address appears on the inside
network.
Figure 1-5
The following commands create an ACL that allows inside source network
10.1.1.0/24 to access the outside destination host 10.1.1.56 (the translated address
of the host 209.165.200.225). The last command applies the ACL to VLAN
interface 100.
host1/Admin(config)# access-list INSIDE extended permit ip 10.1.1.0
255.255.255.0 host 10.1.1.56
host1/Admin(config)# interface vlan 100
host1/Admin(config-if)# access-group input INSIDE
For an example of IP addresses used in outbound ACLs, see
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
OL-16202-01
IP Addresses in ACLs: NAT used for Source and Destination
Addresses
Static NAT
209.165.200.225
Outside
ACE
Inside
ACL
Permit from 10.1.1.0/24
10.1.1.0/24
10.1.1.0/24 209.165.201.4:port
PAT
10.1.1.56
to 10.1.1.56
ACL Configuration Examples
Figure 1-5, an
Figure 1-2.
1-41