Cisco IE 4000, Software Configuration Manual

Page: 566 / 1066

562
Configuring Network Security with ACLs
Monitoring and Maintaining Network Security with ACLs
Monitoring and Maintaining Network Security with ACLs
Configuration Examples for Network Security with ACLs
Creating a Standard ACL: Example
This example shows how to create a standard ACL to deny access to IP host 171.69.198.102, permit access to any
others, and display the results.
Switch (config)# access-list 2 deny host 171.69.198.102
Switch (config)# access-list 2 permit any
Switch(config)# end
Switch# show access-lists
Standard IP access list 2
10 deny 171.69.198.102
20 permit any
Creating an Extended ACL: Example
This example shows how to create and display an extended access list to deny Telnet access from any host in network
171.69.198.0 to any host in network 172.20.52.0 and to permit any others. (The
eq keyword after the destination address
means to test for the TCP destination port number equaling Telnet.)
Switch(config)# access-list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet
Switch(config)# access-list 102 permit tcp any any
Switch(config)# end
Switch# show access-lists
Extended IP access list 102
10 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet
20 permit tcp any any
Command Purpose
show access-lists [ number | name ] Displays the contents of one or all current IP and MAC address access
lists or a specific access list (numbered or named).
show ip access-lists [ number | name ] Displays the contents of all current IP access lists or a specific IP access
list (numbered or named).
show ip interface interface-id Displays detailed configuration and status of an interface. If IP is enabled
on the interface and ACLs have been applied by using the
ip
access-group interface configuration command, the access groups are
included in the display.
show running-config [ interface interface-id ] Displays the contents of the configuration file for the switch or the
specified interface, including all configured MAC and IP access lists and
which access groups are applied to an interface.
show mac access-group
[
interface
interface-i d]
Displays MAC access lists applied to all Layer 2 interfaces or the specified
Layer 2 interface.
show access-lists [ number | name ] Displays the access list configuration.
show time-range Verifies the time-range configuration.
show mac access-group
[
interface
interface-i d]
Displays the MAC access list applied to the interface or all Layer 2
interfaces.