30-15
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Chapter 30 Configuring Network Security with ACLs
Configuring IPv4 ACLs
Switch(config)#
time-range new_year_day_2006
Switch(config-time-range)#
absolute start 00:00 1 Jan 2006 end 23:59 1 Jan 2006
Switch(config-time-range)#
end
Switch#
show time-range
time-range entry: new_year_day_2003 (inactive)
absolute start 00:00 01 January 2006 end 23:59 01 January 2006
time-range entry: workhours (inactive)
periodic weekdays 8:00 to 12:00
periodic weekdays 13:00 to 17:00
To apply a time range, enter the time-range name in an extended ACL that can implement time ranges.
This example shows how to create and verify extended access list 188 that denies TCP traffic from any
source to any destination during the defined holiday times and permits all TCP traffic during work hours.
Switch(config)#
access-list 188 deny tcp any any time-range new_year_day_2006
Switch(config)#
access-list 188 permit tcp any any time-range workhours
Switch(config)#
end
Switch#
show access-lists
Extended IP access list 188
10 deny tcp any any time-range new_year_day_2006 (inactive)
20 permit tcp any any time-range workhours (inactive)
This example uses named ACLs to permit and deny the same traffic.
Switch(config)#
ip access-list extended deny_access
Switch(config-ext-nacl)#
deny tcp any any time-range new_year_day_2006
Switch(config-ext-nacl)#
exit
Switch(config)#
ip access-list extended may_access
Switch(config-ext-nacl)#
permit tcp any any time-range workhours
Switch(config-ext-nacl)#
end
Switch#
show ip access-lists
Extended IP access list lpip_default
10 permit ip any any
Extended IP access list deny_access
10 deny tcp any any time-range new_year_day_2006 (inactive)
Extended IP access list may_access
10 permit tcp any any time-range workhours (inactive)
Including Comments in ACLs
You can use the
remark
keyword to include comments (remarks) about entries in any IP standard or
extended ACL. The remarks make the ACL easier for you to understand and scan. Each remark line is
limited to 100 characters.
The remark can go before or after a permit or deny statement. You should be consistent about where you
put the remark so that it is clear which remark describes which permit or deny statement. For example,
it would be confusing to have some remarks before the associated permit or deny statements and some
remarks after the associated statements.
To include a comment for IP numbered standard or extended ACLs, use the
access-list
access-list
number
remark
remark
global configuration command. To remove the remark, use the
no
form of this
command.
In this example, the workstation that belongs to Jones is allowed access, and the workstation that belongs
to Smith is not allowed access:
Switch(config)#
access-list 1 remark Permit only Jones workstation through
Switch(config)#
access-list 1 permit 171.69.2.88
Switch(config)#
access-list 1 remark Do not allow Smith through
Switch(config)#
access-list 1 deny 171.69.3.13
