Cisco NM-8B-U - HW ROUTERS L-M User Manual page 141

16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series
Including Comments About Entries in ACLs Example
The following example shows an IP numbered standard ACL using the access-list access-list number
remark remark global configuration command to include a comment about an access list. In this
example, the workstation belonging to Jones is allowed access, and the workstation belonging to Smith
is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13
The following example shows an entry in a named IP ACL using the remark access-list global
configuration command to include a comment about an access list. In this example, the Jones subnet is
not allowed to use outbound Telnet:
Switch(config)# ip access-list extended telnetting
Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out
Switch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnet
In this example of a numbered ACL, the workstation belonging to Jones is allowed access, and the
workstation belonging to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13
In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the
web:
Switch(config)# access-list 100 remark Do not allow Winter to browse the web
Switch(config)# access-list 100 deny host 171.69.3.85 any eq www
Switch(config)# access-list 100 remark Do not allow Smith to browse the web
Switch(config)# access-list 100 deny host 171.69.3.13 any eq www
Applying the ACL to an Interface Example
The following example shows how to apply access list 2 on Gigabit Ethernet interface 0/3 to filter
packets entering the interface:
Switch(config)# interface gigabitethernet0/3
Router(config-if)# ip access-group 2 in
Displaying Standard and Extended ACLs Example
The following example displays all standard and extended ACLs:
Switch# show access-lists
Standard IP access list 1
Standard IP ACL 10
Standard IP access list 12
Standard IP access list 32
Standard IP access list 34
Extended IP access list 120
permit 172.20.10.10
permit 12.12.12.12
deny 1.3.3.2
permit 172.20.20.20
permit 10.24.35.56
permit 23.45.56.34
Configuration Examples for the 16- and 36-Port Ethernet Switch Module
Cisco IOS Release 12.2(2)XT, 12.2(8)T, and 12.2(15)ZJ
141