Cisco WS-C3550-12G Software Configuration Manual page 429

Chapter 19 Configuring Network Security with ACLs
Beginning in privileged EXEC mode, follow these steps to restrict incoming and outgoing connections
between a virtual terminal line and the addresses in an ACL:
Command
Step 1 configure terminal
Step 2
line [console | vty] line-number
Step 3
access-class access-list-number
{in | out}
Step 4
end
Step 5 show running-config
Step 6
copy running-config startup-config
To remove access restrictions on a terminal line, use the no access-class access-list-number {in | out}
line configuration command.
Beginning in privileged EXEC mode, follow these steps to control access to a Layer 3 interface:
Command
Step 1
configure terminal
Step 2
interface interface-id
Step 3
ip access-group {access-list-number |
name} {in | out}
Step 4 end
Step 5 show running-config
Step 6
copy running-config startup-config
To remove the specified access group, use the no ip access-group {access-list-number | name} {in | out}
interface configuration command.
This example shows how to apply access list 2 on Gigabit Ethernet interface 0/3 to filter packets entering
the interface:
Switch(config)# interface gigabitethernet0/3
Router(config-if)# ip access-group 2 in
78-11194-03
Purpose
Enter global configuration mode.
Identify a specific line for configuration, and enter in-line configuration
mode.
• console—Enter to specify the console terminal line. The console port
is DCE.
• vty—Enter to specify a virtual terminal for remote console access.
The line-number is the first line number in a contiguous group that you want
to configure when the line type is specified. The range is from 0 to 16.
Restrict incoming and outgoing connections between a particular virtual
terminal line (into a device) and the addresses in an access list.
Return to privileged EXEC mode.
Display the access list configuration.
(Optional) Save your entries in the configuration file.
Purpose
Enter global configuration mode.
Identify a specific interface for configuration, and enter interface
configuration mode.
The interface must be a Layer 3 interface, either a routed port or an SVI
VLAN ID.
Control access to the specified interface.
Return to privileged EXEC mode.
Display the access list configuration.
(Optional) Save your entries in the configuration file.
Catalyst 3550 Multilayer Switch Software Configuration Guide
Configuring Router ACLs
19-19