Cisco Catalyst 2960 Series, Configuration Manual

Page: 1290 / 2288

The marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard 171.69.0.0
0.0.255.255 and denies any other TCP traffic. It permits ICMP traffic, denies UDP traffic from any source to
the destination address range 171.69.0.0 through 179.69.255.255 with a destination port less than 1024, denies
any other IP traffic, and provides a log of the result.
Switch(config)#
ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit icmp any any
Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt 1024
Switch(config-ext-nacl)#
deny ip any any log
Switch(config-ext-nacl)# exit
The Internet_filter ACL is applied to outgoing traffic and the marketing_group ACL is applied to incoming
traffic on a Layer 3 port.
Switch(config)# interface gigabitethernet3/0/2
Switch(config-if)# no switchport
Switch(config-if)# ip address 2.0.5.1 255.255.255.0
Switch(config-if)#
ip access-group Internet_filter out
Switch(config-if)# ip access-group marketing_group in
Deleting individual ACEs from named ACLs
This example shows how you can delete individual ACEs from the named access list border-list :
Switch(config)# ip access-list extended border-list
Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any
Example: Configuring an Access Control Entry with Noncontiguous Ports
The following access list entry can be created because up to ten ports can be entered after the eq and neq
operators:
ip access-list extended aaa
permit tcp any eq telnet ftp any eq 23 45 34
end
Enter the
show access-lists
command to display the newly created access list entry.
Device# show access-lists aaa
Extended IP access list aaa
10 permit tcp any eq telnet ftp any eq 23 45 34
Example: Consolidating Access List Entries with Noncontiguous Ports into One Access List Entry
The show access-lists command is used to display a group of access list entries for the access list named abc:
Device#
show access-lists abc
Extended IP access list abc
10 permit tcp any eq telnet any eq 450
20 permit tcp any eq telnet any eq 679
30 permit tcp any eq ftp any eq 450
40 permit tcp any eq ftp any eq 679
Because the entries are all for the same permit statement and simply show different ports, they can be
consolidated into one new access list entry. The following example shows the removal of the redundant access
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1208
Configuration Examples for ACLs