Table of Contents
Advertisement
Chapter 34
Configuring Network Security with ACLs
Use one of these workarounds:
•
•
To determine the specialized hardware resources, enter the show platform layer4 acl map privileged
EXEC command. If the switch does not have available resources, the output shows that index 0 to
index 15 are not available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug
Toolkit.
For example, if you apply this ACL to an interface:
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
permit tcp source source-wildcard destination destination-wildcard
And if this message appears:
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The flag-related operators are not available. To avoid this issue,
•
•
You can now apply the first ACE in the ACL to the interface. The switch allocates the ACE to available
mapping bits in the Opselect index and then allocates flag-related operators to use the same bits in the
hardware memory.
IPv4 ACL Configuration Examples
This section provides examples of configuring and applying IPv4 ACLs. For detailed information about
compiling ACLs, see the Cisco IOS Security Configuration Guide, Release 12.2 and to the Configuring
IP Services" section in the "IP Addressing and Services" chapter of the Cisco IOS IP Configuration
Guide, Release 12.2.
Figure 34-3
containing benefits and other information that all employees can access, and routed Port 1 connected to
blade server B, containing confidential payroll data. All users can access blade server A, but Blade
server B has restricted access.
Use router ACLs to do this in one of two ways:
•
•
OL-12247-04
Modify the ACL configuration to use fewer resources.
Rename the ACL with a name or number that alphanumerically precedes the ACL names or
numbers.
Move the fourth ACE before the first ACE by using ip access-list resequence global configuration
command:
permit tcp source source-wildcard destination destination-wildcard
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
or
Rename the ACL with a name or number that alphanumerically precedes the other ACLs (for
example, rename ACL 79 to ACL 1).
shows a small networked office environment with routed Port 2 connected to blade server A,
Create a standard ACL, and filter traffic coming to the server from port 1.
Create an extended ACL, and filter traffic coming from the server into port 1.
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
Configuring IPv4 ACLs
34-23
Advertisement
Chapters
Table of Contents
Troubleshooting
