Cisco NM-8B-U - HW ROUTERS L-M User Manual page 78

Configuration Tasks
Configuring Network Security with ACLs
Configuring ACLs on Layer 2 interfaces is the same as configuring ACLs on Cisco routers. The process
is briefly described here. For more detailed information on configuring router ACLs, refer to the
"Configuring IP Services" chapter in the Cisco IP Configuration Guide for Cisco IOS Release 12.2. For
detailed information about the commands, refer to Cisco IOS IP Command Reference for Cisco IOS
Release 12.2. For a list of Cisco IOS features not supported on the Ethernet switch network module, see
the following section.
Unsupported Features
The Ethernet switch network module does not support these Cisco IOS router ACL-related features:
•
•
•
•
•
•
•
•
•
•
Creating Standard and Extended IP ACLs
This section describes how to create switch IP ACLs. An ACL is a sequential collection of permit and
deny conditions. The switch tests packets against the conditions in an access list one by one. The first
match determines whether the switch accepts or rejects the packet. Because the switch stops testing
conditions after the first match, the order of the conditions is critical. If no conditions match, the switch
denies the packet.
An ACL must first be created by specifying an access list number or name and access conditions. The
ACL can then be applied to interfaces or terminal lines.
The software supports these styles of ACLs or IP access lists:
•
•
The next sections describe access lists and the steps for using them.
Cisco IOS Release 12.2(2)XT, 12.2(8)T, and 12.2(15)ZJ
78
16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series
Non-IP protocol ACLs (see
Bridge-group ACLs.
IP accounting.
ACL support on the outbound direction.
Inbound and outbound rate limiting (except with QoS ACLs).
IP packets with a header length of less than five are not be access-controlled.
Reflexive ACLs.
Dynamic ACLs.
ICMP-based filtering.
IGMP-based filtering.
Standard IP access lists use source addresses for matching operations.
Extended IP access lists use source and destination addresses for matching operations and optional
protocol-type information for finer granularity of control.
Table 11 on page 79).