Cisco 1941, Configuration Manual

Page: 137 / 408

129
Cisco 3900 Series, Cisco 2900 Series, and Cisco 1900 Series Integrated Services Routers Generation 2 Software Configuration Guide
Chapter Configuring Security Features
Configuring Access Lists
Configuring Access Lists
Access lists permit or deny network traffic over an interface, based on source IP address, destination IP
address, or protocol. Access lists are configured as standard or extended. A standard access list either
permits or denies passage of packets from a designated source. An extended access list allows
designation of both the destination and the source, and it allows designation of individual protocols to
be permitted or denied passage.
For more complete information on creating access lists, see the “Access Control Lists” section of Cisco
IOS Security Configuration Guide: Securing the Data Plane, Release 12.4T at:
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/12_4t/
sec_data_plane_12_4t_book.html
.
An access list is a series of commands with a common tag to bind them together. The tag is either a
number or a name.
Table 1 lists the commands used to configure access lists.
To create, refine, and manage access lists, see the following sections of the “Access Control Lists”
section of Cisco IOS Security Configuration Guide: Securing the Data Plane, Release 12.4T at:
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/12_4t/
sec_data_plane_12_4t_book.html
:
• Creating an IP Access List and Applying It to an Interface
•
Creating an IP Access List to Filter IP Options, TCP Flags, Noncontiguous Ports, or TTL Values
•
Refining an IP Access List
•
Displaying and Clearing IP Access List Data Using ACL Manageability
Access Groups
An access group is a sequence of access list definitions bound together with a common name or number.
An access group is enabled for an interface during interface configuration. Use the following guidelines
when creating access groups:
•
The order of access list definitions is significant. A packet is compared against the first access list
in the sequence. If there is no match (that is, if neither a permit nor a deny occurs), the packet is
compared with the next access list, and so on.
•
All parameters must match the access list before the packet is permitted or denied.
•
There is an implicit “deny all” at the end of all sequences.
Table 1 Access List Configuration Commands
Access Control List (ACL) Type Configuration Commands
Numbered
Standard access-list { 1-99 }{ permit | deny } source-addr [ source-mask ]
Extended access-list { 100-199 }{ permit | deny } protocol source-addr
[ source-mask ] destination-addr [ destination-mask ]
Named
Standard ip access-list standard name deny { source | source-wildcard | any }
Extended ip access-list extended name {permit | deny} protocol { source-addr
[ source-mask ] | any }{ destination-addr [ destination-mask ] | any }