26-25
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Chapter 26 Configuring Network Security with ACLs
Configuring IPv4 ACLs
!
Switch(config)#
ip access-list extended strict
Switch(config-ext-nacl)#
deny tcp any any eq www time-range no-http
Switch(config-ext-nacl)#
permit udp any any time-range udp-yes
!
Switch(config-ext-nacl)#
exit
Switch(config)#
interface gigabitethernet0/1
Switch(config-if)#
ip access-group strict in
Commented IP ACL Entries
In this example of a numbered ACL, the workstation that belongs to Jones is allowed access, and the
workstation that belongs to Smith is not allowed access:
Switch(config)#
access-list 1 remark Permit only Jones workstation through
Switch(config)#
access-list 1 permit 171.69.2.88
Switch(config)#
access-list 1 remark Do not allow Smith workstation through
Switch(config)#
access-list 1 deny 171.69.3.13
In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the
web:
Switch(config)#
access-list 100 remark Do not allow Winter to browse the web
Switch(config)#
access-list 100 deny host 171.69.3.85 any eq www
Switch(config)#
access-list 100 remark Do not allow Smith to browse the web
Switch(config)#
access-list 100 deny host 171.69.3.13 any eq www
In this example of a named ACL, the Jones subnet is not allowed access:
Switch(config)#
ip access-list standard prevention
Switch(config-std-nacl)#
remark Do not allow Jones subnet through
Switch(config-std-nacl)#
deny 171.69.0.0 0.0.255.255
In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet:
Switch(config)#
ip access-list extended telnetting
Switch(config-ext-nacl)#
remark Do not allow Jones subnet to telnet out
Switch(config-ext-nacl)#
deny tcp 171.69.0.0 0.0.255.255 any eq telnet
ACL Logging
Two variations of logging are supported on router ACLs. The log keyword sends an informational
logging message to the console about the packet that matches the entry; the log-input keyword includes
the input interface in the log entry.
In this example, standard named access list stan1 denies traffic from 10.1.1.0 0.0.0.255, allows traffic
from all other sources, and includes the log keyword.
Switch(config)#
ip access-list standard stan1
Switch(config-std-nacl)#
deny 10.1.1.0 0.0.0.255 log
Switch(config-std-nacl)#
permit any log
Switch(config-std-nacl)#
exit
Switch(config)#
interface gigabitethernet0/1
Switch(config-if)#
ip access-group stan1 in
Switch(config-if)#
end
Switch#
show logging
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: level debugging, 37 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 37 messages logged
File logging: disabled
Trap logging: level debugging, 39 message lines logged
