Configuring Ip Acls - Cisco WS-C3560-48PS-S Software Configuration Manual

Configuring IP ACLs

•
Configuring IP ACLs
Configuring IP ACLs on the switch is the same as configuring IP ACLs on other Cisco switches and
routers. The process is briefly described here. For more detailed information on configuring ACLs, refer
to the "Configuring IP Services" chapter in the Cisco IP and IP Routing Configuration Guide for IOS
Release 12.1. For detailed information about the commands, refer to Cisco IOS IP and IP Routing
Command Reference for IOS Release 12.1.
The switch does not support these Cisco IOS router ACL-related features:
•
•
•
•
•
These are the steps to use IP ACLs on the switch:
Create an ACL by specifying an access list number or name and access conditions.
Step 1
Apply the ACL to interfaces or terminal lines. You can also apply standard and extended IP ACLs to
Step 2
VLAN maps.
This section includes the following information:
•
•
•
•
•
Catalyst 3560 Switch Software Configuration Guide
27-6
Because the first fragment was denied, host 10.1.1.2 cannot reassemble a complete packet, so packet
B is effectively denied. However, the later fragments that are permitted will consume bandwidth on
the network and resources of host 10.1.1.2 as it tries to reassemble the packet.
Fragmented packet C is from host 10.2.2.2, port 65001, going to host 10.1.1.3, port ftp. If this packet
is fragmented, the first fragment matches the fourth ACE (a deny). All other fragments also match
the fourth ACE because that ACE does not check any Layer 4 information and because Layer 3
information in all fragments shows that they are being sent to host 10.1.1.3, and the earlier permit
ACEs were checking different hosts.
Non-IP protocol ACLs (see
IP accounting
Inbound and outbound rate limiting (except with QoS ACLs)
Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch
clustering feature)
ACL logging for port ACLs and VLAN maps
Creating Standard and Extended IP ACLs, page 27-7
Applying an IP ACL to a Terminal Line, page 27-18
Applying an IP ACL to an Interface, page 27-19
Hardware and Software Treatment of IP ACLs, page 27-21
IP ACL Configuration Examples, page 27-21
Table 27-1 on page 27-7) or bridge-group ACLs
Chapter 27 Configuring Network Security with ACLs
78-16156-01