Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 237 / 742

13-11
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 13 Identifying Traffic with Access Lists
Adding a Standard Access List
The following access list denies traffic with EtherType 0x1256, but allows all others on both interfaces:
hostname(config)# access-list nonIP ethertype deny 1256
hostname(config)#
access-list nonIP ethertype permit any
hostname(config)# access-group ETHER in interface inside
hostname(config)# access-group ETHER in interface outside
Adding a Standard Access List
Standard access lists are used in some commands to identify the destination IP addresses only. For
example, you use a standard access list to identify the destination addresses of OSPF routes for use in a
route map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic.
The following command adds a standard ACE. To add another ACE at the end of the access list, enter
another
access-list command specifying the same access list name.
To add an ACE, enter the following command:
hostname(config)# access-list access_list_name standard { deny | permit } { any | ip_address
mask }
The following sample access list identifies routes to 192.168.1.0/24:
hostname(config)# access-list OSPF standard permit 192.168.1.0 255.255.255.0
Simplifying Access Lists with Object Grouping
This section describes how to use object grouping to simplify access list creation and maintenance. This
section includes the following topics:
•
How Object Grouping Works, page 13-11
• Adding Object Groups, page 13-12
•
Nesting Object Groups, page 13-15
• Displaying Object Groups, page 13-17
•
Removing Object Groups, page 13-17
• Using Object Groups with an Access List, page 13-16
How Object Grouping Works
By grouping like-objects together, you can use the object group in an ACE instead of having to enter an
ACE for each object separately. You can create the following types of object groups:
• Protocol
•
Network
• Service
•
ICMP type
For example, consider the following three object groups:
•
MyServices—Includes the TCP and UDP port numbers of the service requests that are allowed
access to the internal network