Chapter 17 Configuring The Ip Permit List; Understanding How The Ip Permit List Works - Cisco WS-C4003 - Catalyst 4000 Chassis Switch Software Configuration Manual

Configuring the IP Permit List
This chapter describes how to configure the IP permit list on the Catalyst enterprise LAN switches.
For complete syntax and usage information for the commands used in this chapter, refer to the Command
Note
Reference—Catalyst 4000 Family, Catalyst 2948G, and Catalyst 2980G Switches.
This chapter consists of these sections:
•
•
•

Understanding How the IP Permit List Works

IP permit prevents inbound Telnet and SNMP access to the switch from unauthorized source IP
addresses. All other TCP/IP services (such as IP traceroute and IP ping) continue to work normally when
you enable the IP permit list. Outbound Telnet, Trivial File Transfer Protocol (TFTP), and other IP-based
services are unaffected by the IP permit list.
Telnet attempts from unauthorized source IP addresses are denied a connection. SNMP requests from
unauthorized IP addresses receive no response; the request times out. If you want to log unauthorized
access attempts to the console or a syslog server, you must change the logging severity level for IP, as
described in the
when unauthorized access attempts are made, you must enable IP permit list (ippermit) SNMP traps, as
described in the
unauthorized host only trigger notifications every ten minutes.
You can configure up to 100 entries in the permit list. Each entry consists of an IP address and subnet
mask pair in dotted decimal format and information on whether the IP address is part of the SNMP
permit list, Telnet permit list, or both lists. The bits set to one in the mask are checked for a match with
the source IP address of incoming packets, while the bits set to zero are not checked. This process allows
wildcard addresses to be specified.
If you do not specify the mask for an IP permit list entry, or if you enter a host name instead of an IP
address, the mask has an implicit value of all bits set to one (255.255.255.255 or 0xffffffff), which
matches only the IP address of that host.
If you do not specify SNMP or Telnet for the type of permit list for the IP address, the IP address is added
to both the SNMP and Telnet permit lists.
78-12647-02
Understanding How the IP Permit List Works, page 17-1
IP Permit List Default Configuration, page 17-2
Configuring the IP Permit List, page 17-2
"Enabling IP Permit List" section on page
"Enabling IP Permit List" section on page
Software Configuration Guide—Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4
C H A P T E R
17-3. If you want to generate SNMP traps
17-3. Multiple access attempts from the same
17
17-1