Configuration Examples For Acls And Vlan Maps; Example: Creating An Acl And A Vlan Map To Deny A Packet; Example: Creating An Acl And A Vlan Map To Permit A Packet; Example: Default Action Of Dropping Ip Packets And Forwarding Mac Packets - Cisco Catalyst 2960-X Security Configuration Manual
Cisco ios release 15.0(2)ex
Hide thumbs
Also See for Catalyst 2960-X:
- Command reference manual (135 pages) ,
- Hardware installation manual (34 pages) ,
- Getting started manual (25 pages)
Table of Contents
Advertisement
Configuring IPv4 ACLs
This is an example of an output message when the log-input keyword is entered:
00:04:21:%SEC-6-IPACCESSLOGDP:list inputlog permitted icmp 10.1.1.10 (Vlan1 0001.42ef.a400)
->
10.1.1.61 (0/0), 1 packet
A log message for the same sort of packet using the log keyword does not include the input interface
information:
00:05:47:%SEC-6-IPACCESSLOGDP:list inputlog permitted icmp 10.1.1.10 -> 10.1.1.61 (0/0), 1
packet
Configuration Examples for ACLs and VLAN Maps
Example: Creating an ACL and a VLAN Map to Deny a Packet
This example shows how to create an ACL and a VLAN map to deny a packet. In the first map, any packets
that match the ip1 ACL (TCP packets) would be dropped. You first create the ip1 ACL to permit any TCP
packet and no other packets. Because there is a match clause for IP packets in the VLAN map, the default
action is to drop any IP packet that does not match any of the match clauses.
Switch(config)# ip access-list extended ip1
Switch(config-ext-nacl)# permit tcp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 10
Switch(config-access-map)# match ip address ip1
Switch(config-access-map)# action drop
Example: Creating an ACL and a VLAN Map to Permit a Packet
This example shows how to create a VLAN map to permit a packet. ACL ip2 permits UDP packets and any
packets that match the ip2 ACL are forwarded. In this map, any IP packets that did not match any of the
previous ACLs (that is, packets that are not TCP packets or UDP packets) would get dropped.
Switch(config)# ip access-list extended ip2
Switch(config-ext-nacl)# permit udp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 20
Switch(config-access-map)# match ip address ip2
Switch(config-access-map)# action forward
Example: Default Action of Dropping IP Packets and Forwarding MAC Packets
In this example, the VLAN map has a default action of drop for IP packets and a default action of forward
for MAC packets. Used with standard ACL 101 and extended named access lists igmp-match and tcp-match,
the map will have the following results:
• Forward all UDP packets
• Drop all IGMP packets
• Forward all TCP packets
OL-29048-01
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
Configuration Examples for ACLs and VLAN Maps
187
Hide quick links:
Advertisement
Table of Contents
