Including Comments About Entries In Acls - Cisco Catalyst 2950 Software Configuration Manual

Chapter 23 Configuring Network Security with ACLs
Configuring ACLs
When making the standard and extended ACL, remember that, by default, the end of the ACL contains
an implicit deny statement for everything if it did not find a match before reaching the end. For standard
ACLs, if you omit the mask from an associated IP host address access list specification, 0.0.0.0 is
assumed to be the mask.
After you create an ACL, any additions are placed at the end of the list. You cannot selectively add ACEs
to a specific ACL. However, you can use no permit and no deny commands to remove ACEs from a
named ACL. This example shows how you can delete individual ACEs from a named ACL:
Switch(config)# ip access-list extended border-list
Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any
Being able to selectively remove lines from a named ACL is one reason you might use named ACLs
instead of numbered ACLs.
After creating an ACL, you must apply it to a line or interface, as described in the "Applying the ACL
to an Interface or Terminal Line" section on page 23-15.

Including Comments About Entries in ACLs

You can use the remark command to include comments (remarks) about entries in any IP standard or
extended ACL. The remarks make the ACL easier for you to understand and scan. Each remark line is
limited to 100 characters.
The remark can go before or after a permit or deny statement. You should be consistent about where you
put the remark so that it is clear which remark describes which permit or deny statement. For example,
it would be confusing to have some remarks before the associated permit or deny statements and some
remarks after the associated statements.
For IP numbered standard or extended ACLs, use the access-list access-list number remark remark
global configuration command to include a comment about an access list. To remove the remark, use the
no form of this command.
In this example, the workstation belonging to Jones is allowed access, and the workstation belonging to
Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13
For an entry in a named IP ACL, use the remark access-list global configuration command. To remove
the remark, use the no form of this command.
In this example, the Jones subnet is not allowed to use outbound Telnet:
Switch(config)# ip access-list extended telnetting
Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out
Switch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnet
Catalyst 2950 Desktop Switch Software Configuration Guide
23-14
78-11380-04