Applying An Ip-Acl To Mgmt0; Verifying Interface Ip-Acl Configuration - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Chapter 35 Configuring IPv4 and IPv6 Access Control Lists
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Command
Step 4
switch(config-if)# ip access-group restrict_mgmt in
switch(config-if)# no ip access-group restrict_mgmt
in
switch(config-if)# ip access-group SampleName2 out
switch(config-if)# no ip access-group SampleName2 out
To apply an IPv6-ACL to an interface, follow these steps:
Command
Step 1
switch# config t
Step 2
switch(config)# interface mgmt0
switch(config-if)#
Step 3
switch(config-if)# ipv6 traffic-filter
RestrictMgmt in
switch(config-if)# no ipv6 traffic-filter
RestrictMgmt in
switch(config-if)# ipv6 traffic-filter
SampleName2 out
switch(config-if)# no ipv6 traffic-filter
SampleName2 out

Applying an IP-ACL to mgmt0

A system default ACL called mgmt0 exists on the mgmt0 interface. This ACL is not visible to the user,
so mgmt0 is a reserved ACL name that cannot be used. The mgmt0 ACL blocks most ports and only
allows access to required ports in line with accepted security policies.

Verifying Interface IP-ACL Configuration

Use the show interface command to display the IPv4-ACL configuration on an interface.
switch# show interface mgmt 0
mgmt0 is up
OL-18084-01, Cisco MDS NX-OS Release 4.x
Hardware is FastEthernet
Address is 000c.30d9.fdbc
Internet address is 172.22.31.113/24
MTU 1500 bytes, BW 100 Mbps full Duplex
ip access-group restrict_mgmt in
35988 packets input, 3105539 bytes
0 multicast frames, 0 compressed
0 input errors, 0 frame, 0 overrun 0 fifo
2495 packets output, 430547 bytes, 0 underruns
0 output errors, 0 collisions, 0 fifo
Purpose
Applies an IPv4-ACL called
restrict_mgmt (if it does not already
exist) for ingress traffic.
Removes the IPv4-ACL called
restrict_mgmt for ingress traffic.
Applies an IPv4-ACL called
SampleName2 (if it does not already
exist) for egress traffic.
Removes the IPv4-ACL called
SampleName2 for egress traffic.
Purpose
Enters configuration mode.
Configures a management interface (mgmt0).
Applies an IPv6-ACL called RestrictMgmt (if it does
not already exist) for ingress traffic.
Removes the IPv6-ACL called RestrictMgmt for
ingress traffic.
Applies an IPv6-ACL called SampleName2 (if it
does not already exist) for egress traffic.
Removes the IPv6-ACL called SampleName2 for
egress traffic.
Cisco MDS 9000 Family CLI Configuration Guide
Applying an IP-ACL to mgmt0
35-11