19-13
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
Chapter 19 Configuring Network Security with ACLs
Configuring Router ACLs
Use the no access-list access-list-number global configuration command to delete the entire access list.
You cannot delete individual ACEs from numbered access lists.
This example shows how to create and display an extended access list to deny Telnet access from any
host in network 171.69.198.0 to any host in network 172.20.52.0 and permit any others. (The eq keyword
after the destination address means to test for the TCP destination port number equaling Telnet.)
Switch(config)# access-list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq
telnet
Switch(config)# access-list 102 permit tcp any any
Switch(config)# end
Switch# show access-lists
Extended IP access list 102
deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet
permit tcp any any
After an ACL is created, any additions (possibly entered from the terminal) are placed at the end of the
list. You cannot selectively add or remove access list entries from a numbered access list.
Note
When you are creating an ACL, remember that, by default, the end of the access list contains an
implicit deny statement for all packets if it did not find a match before reaching the end.
After creating an ACL, you must apply it to a line or interface, as described in the
“Applying the ACL
to an Interface or Terminal Line” section on page 19-18
.
Step 2d
access-list access-list-number
{deny | permit} icmp source
source-wildcard destination
destination-wildcard [icmp-type |
[[icmp-type icmp-code] |
[icmp-message]] [precedence
precedence] [tos tos] [fragments]
[log] [log-input] [time-range
time-range-name] [dscp dscp]
(Optional) Define an extended ICMP access list and the access conditions.
Enter icmp for Internet Control Message Protocol.
The ICMP parameters are the same as those described for most IP protocols in
Step 2a, with the addition of the ICMP message type and code parameters.
These optional keywords have these meanings:
•
icmp-type—Enter to filter by ICMP message type, a number from 0 to 255.
•
icmp-code—Enter to filter ICMP packets that are filtered by ICMP message
type by the ICMP message code, a number from 0 to 255.
•
icmp-message—Enter to filter ICMP packets by ICMP message type name
or ICMP message type and code name. To see a list of ICMP message type
names and ICMP message type and code names, use the ? or refer to the
“Configuring IP Services” section of Cisco IOS IP and IP Routing
Command Reference for IOS Release 12.1.
Step 2e
access-list access-list-number
{deny | permit} igmp source
source-wildcard destination
destination-wildcard [igmp-type]
[precedence precedence] [tos tos]
[fragments] [log] [log-input]
[time-range time-range-name]
[dscp dscp]
(Optional) Define an extended IGMP access list and the access conditions.
Enter igmp for Internet Group Management Protocol.
The IGMP parameters are the same as those described for most IP protocols in
Step 2a, with the addition of this optional parameter.
igmp-type—To match IGMP message type, enter a number from 0 to 15, or enter
the message name (dvmrp, host-query, host-report, pim, or trace).
Step 3
show access-lists [number | name] Verify the access list configuration.
Step 4
copy running-config
startup-config
(Optional) Save your entries in the configuration file.
Command
Purpose
