Table of Contents
Advertisement
Configuring Network Security with ACLs
Configuration Examples for Network Security with ACLs
permit ip any 172.20.128.64 0.0.0.31
Switch(config)# interface GigabitEthernet1/17
Switch(config-if)# ip access-group 106 in
Configuring Numbered ACLs: Example
In this example, network 36.0.0.0 is a Class A network whose second octet specifies a subnet; that is, its subnet mask
is 255.255.0.0. The third and fourth octets of a network 36.0.0.0 address specify a particular host. Using access list 2,
the switch accepts one address on subnet 48 and reject all others on that subnet. The last line of the list shows that the
switch accepts addresses on all other network 36.0.0.0 subnets. The ACL is applied to packets entering a port.
Switch(config)# access-list 2 permit 36.48.0.3
Switch(config)# access-list 2 deny 36.48.0.0 0.0.255.255
Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255
Switch(config)# interface GigabitEthernet1/17
Switch(config-if)# ip access-group 2 in
Configuring Extended ACLs: Examples
In this example, the first line permits any incoming TCP connections with destination ports greater than 1023. The second
line permits incoming TCP connections to the Simple Mail Transfer Protocol (SMTP) port of host 128.88.1.2. The third
line permits incoming ICMP messages for error feedback.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 gt 1023
Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25
Switch(config)# access-list 102 permit icmp any any
Switch(config)# interface GigabitEthernet1/17
Switch(config-if)# ip access-group 102 in
In this example, suppose that you have a network connected to the Internet, and you want any host on the network to be
able to form TCP connections to any host on the Internet. However, you do not want IP hosts to be able to form TCP
connections to hosts on your network, except to the mail (SMTP) port of a dedicated mail host.
SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The same port
numbers are used throughout the life of the connection. Mail packets coming in from the Internet have a destination port
of 25. Outbound packets have the port numbers reversed. Because the secure system of the network always accepts
mail connections on port 25, the incoming and outgoing services are separately controlled. The ACL must be configured
as an input ACL on the outbound interface and an output ACL on the inbound interface.
In this example, the network is a Class B network with the address 128.88.0.0, and the mail host address is 128.88.1.2.
The established keyword is used only for the TCP to show an established connection. A match occurs if the TCP
datagram has the ACK or RST bits set, which show that the packet belongs to an existing connection. Gigabit Ethernet
interface 1 is the interface that connects the router to the Internet.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established
Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25
Switch(config)# interface GigabitEthernet1/17
Switch(config-if)# ip access-group 102 in
Creating Named ACLs: Example
This example creates a standard ACL named Internet_filter and an extended ACL named marketing_group. The
Internet_filter ACL allows all traffic from the source address 1.2.3.4.
Switch(config)# ip access-list standard Internet_filter
Switch(config-ext-nacl)# permit 1.2.3.4
Switch(config-ext-nacl)# exit
566
- Quick Links:
- Configuration Overview
Hide quick links:
Advertisement
Chapters
Table of Contents
Troubleshooting
