Chapter 18 Configuring The Ip Permit List; Understanding How The Ip Permit List Works - Cisco WS-C2948G-GE-TX Configuration Manual

Configuring the IP Permit List
This chapter describes how to configure the IP permit list on the Catalyst enterprise LAN switches.
For complete syntax and usage information for the commands that are used in this chapter, refer to the
Note
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Command
Reference.
This chapter consists of these sections:
•
•
•

Understanding How the IP Permit List Works

The IP permit list prevents inbound Telnet and SNMP access to the switch from unauthorized source IP
addresses. All other TCP/IP services (such as IP traceroute and IP ping) continue to work normally when
you enable the IP permit list. Outbound Telnet, Trivial File Transfer Protocol (TFTP), and other IP-based
services are unaffected by the IP permit list.
Telnet attempts from unauthorized source IP addresses are denied a connection. SNMP requests from
unauthorized IP addresses receive no response; the request times out. If you want to log unauthorized
access attempts to the console or a syslog server, you must change the logging severity level for IP, as
described in the
when unauthorized access attempts are made, you must enable IP permit list (ippermit) SNMP traps, as
described in the
same unauthorized host only trigger notifications every 10 minutes.
You can configure up to 100 entries in the permit list. Each entry consists of an IP address and subnet
mask pair in dotted decimal format and information on whether the IP address is part of the SNMP
permit list, Telnet permit list, or both lists. The bits set to one in the mask are checked for a match with
the source IP address of incoming packets, while the bits set to zero are not checked. This process allows
wildcard addresses to be specified.
If you do not specify the mask for an IP permit list entry, or if you enter a host name instead of an IP
address, the mask has an implicit value of all bits set to one (255.255.255.255 or 0xffffffff), which
matches only the IP address of that host.
If you do not specify SNMP or Telnet for the type of permit list for the IP address, the IP address is added
to both the SNMP and Telnet permit lists.
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Understanding How the IP Permit List Works, page 18-1
IP Permit List Default Configuration, page 18-2
Configuring the IP Permit List on the Switch, page 18-2
"Enabling the IP Permit List" section on page
"Enabling the IP Permit List" section on page
C H A P T E R
18-3. If you want to generate SNMP traps
18-3. Multiple access attempts from the
18
18-1