Filter
Top Products
25-25
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 25 Configuring Network Security with ACLs
Examples for Compiling ACLs
Numbered ACL Examples
This example shows that the switch accepts addresses on network 36.0.0.0 subnets and denies all packets
coming from 56.0.0.0 subnets. The ACL is then applied to packets entering Gigabit Ethernet interface
0/1.
Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255
Switch(config)# access-list 2 deny 56.0.0.0 0.255.255.255
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 2 in
Extended ACL Examples
In this example of using an extended ACL, you have a network connected to the Internet, and you want
any host on the network to be able to form TCP Telnet and SMTP connections to any host on the Internet.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 23
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 25
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 102 in
SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The
same port numbers are used throughout the life of the connection. Mail packets coming in from the
Internet have a destination port of 25. Because the secure system behind the switch always accepts mail
connections on port 25, the incoming services are controlled.
Named ACL Example
The Marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard
171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits any other IP traffic.
Switch(config)# ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit ip any any
The ACLs are applied to permit Gigabit Ethernet port 0/1, which is configured as a Layer 2 port, with
the Marketing_group ACL applied to incoming traffic.
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group marketing_group in
...
Commented IP ACL Entry Examples
In this example of a numbered ACL, the workstation belonging to Jones is allowed access, and the
workstation belonging to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13