Dell PowerConnect B-RX Configuration Manual page 593

To configure an extended access list that blocks all Telnet traffic received on port 1/1 from IP host
209.157.22.26, create the ACL with permit and deny rules, then bind the ACL to port 1/1 using the
ip access-group command. Enter the following commands.
BigIron RX(config)# access-list 101 deny tcp host 209.157.22.26 any eq telnet log
BigIron RX(config)# access-list 101 permit ip any any
BigIron RX(config)# int eth 1/1
BigIron RX(config-if-e10000-1/1)# ip access-group 101 in
BigIron RX(config)# write memory
Here is another example of commands for configuring an extended ACL and applying it to an
interface. These examples show many of the syntax choices. Notice that some of the entries are
configured to generate log entries while other entries are not thus configured.
BigIron RX(config)# access-list 102 perm icmp 209.157.22.0/24 209.157.21.0/24
BigIron RX(config)# access-list 102 deny igmp host rkwong 209.157.21.0/24 log
BigIron RX(config)# access-list 102 deny igrp 209.157.21.0/24 host rkwong log
BigIron RX(config)# access-list 102 deny ip host 209.157.21.100 host 209.157.22.1
log
BigIron RX(config)# access-list 102 deny ospf any any log
BigIron RX(config)# access-list 102 permit ip any any
The first entry permits ICMP traffic from hosts in the 209.157.22.x network to hosts in the
209.157.21.x network.
The second entry denies IGMP traffic from the host device named "rkwong" to the 209.157.21.x
network.
The third entry denies IGRP traffic from the 209.157.21.x network to the host device named
"rkwong".
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates
Syslog entries for packets that are denied by this entry.
The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
The following commands apply ACL 102 to the incoming and outgoing traffic on port 1/2 and to the
incoming traffic on port 4/3.
BigIron RX(config)# int eth 1/2
BigIron RX(config-if-e10000-1/2)# ip access-group 102 in
BigIron RX(config-if-e10000-1/2)# exit
BigIron RX(config)# int eth 4/3
BigIron RX(config-if-e10000-4/3)# ip access-group 102 in
BigIron RX(config)# write memory
Here is another example of an extended ACL.
BigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24
BigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp
209.157.22.0/24
BigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt
telnet neq 5
BigIron RX(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24 range
7 8
BigIron RX(config)# access-list 103 permit ip any any
BigIron RX Series Configuration Guide
53-1001810-01
Configuring numbered and named ACLs
21
521