![background image](http://html.mh-extra.com/html/foundry-networks/switch-and-router/switch-and-router_installation-and-configuration-manual_2324275399.webp)
Using Access Control Lists (ACLs)
December 2000
13 - 11
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates Syslog entries
for packets that are denied by this entry.
The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL
would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.
The following commands apply ACL 102 to the incoming and outgoing traffic on port 1/2 and to the incoming traffic
on port 4/3.
BigIron(config)# int eth 1/2
BigIron(config-if-1/2)# ip access-group 102 in
BigIron(config-if-1/2)# ip access-group 102 out
BigIron(config-if-1/2)# exit
BigIron(config)# int eth 4/3
BigIron(config-if-4/3)# ip access-group 102 in
BigIron(config)# write memory
Here is another example of an extended ACL.
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt telnet
neq 5
BigIron(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24 range 7 8
BigIron(config)# access-list 103 permit any any
The first entry in this ACL denies TCP traffic from the 209.157.21.
x
network to the 209.157.22.x network.
The second entry denies all FTP traffic from the 209.157.21.
x
network to the 209.157.22.x network.
The third entry denies TCP traffic from the 209.157.21.
x
network to the 209.157.22.
x
network, if the TCP port
number of the traffic is less than the well-known TCP port number for Telnet (23), and if the TCP port is not equal
to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than 23 are allowed.
The fourth entry denies UDP packets from any source to the 209.157.22.
x
network, if the UDP port number from
the source network is 5 or 6 and the destination UDP port is 7 or 8.
The fifth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL
would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.
The following commands apply ACL 103 to the incoming and outgoing traffic on ports 2/1 and 2/2.
BigIron(config)# int eth 2/1
BigIron(config-if-2/1)# ip access-group 103 in
BigIron(config-if-2/1)# ip access-group 103 out
BigIron(config-if-2/1)# exit
BigIron(config)# int eth 2/2
BigIron(config-if-2/2)# ip access-group 103 in
BigIron(config-if-2/2)# ip access-group 103 out
BigIron(config)# write memory
Filtering on IP Precedence and TOS Values
To configure an extended IP ACL that matches based on IP precedence, enter commands such as the following:
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 precedence
internet
BigIron(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24
precedence 6
BigIron(config)# access-list 103 permit any any
The first entry in this ACL denies TCP traffic from the 209.157.21.
x
network to the 209.157.22.x network, if the
traffic has the IP precedence option “internet” (equivalent to “6”).
Summary of Contents for Switch and Router
Page 2: ...December 2000 Copyright 2000 by Foundry Networks Inc ...
Page 26: ...Foundry Switch and Router Installation and Configuration Guide xxvi December 2000 ...
Page 64: ...Foundry Switch and Router Installation and Configuration Guide 2 34 December 2000 ...
Page 162: ...Foundry Switch and Router Installation and Configuration Guide 5 38 December 2000 ...
Page 196: ...Foundry Switch and Router Installation and Configuration Guide 6 34 December 2000 ...
Page 208: ...Foundry Switch and Router Installation and Configuration Guide 7 12 December 2000 ...
Page 236: ...Foundry Switch and Router Installation and Configuration Guide 8 28 December 2000 ...
Page 258: ...Foundry Switch and Router Installation and Configuration Guide 9 22 December 2000 ...
Page 420: ...Foundry Switch and Router Installation and Configuration Guide 13 32 December 2000 ...
Page 442: ...Foundry Switch and Router Installation and Configuration Guide 14 22 December 2000 ...
Page 554: ...Foundry Switch and Router Installation and Configuration Guide 15 112 December 2000 ...
Page 574: ...Foundry Switch and Router Installation and Configuration Guide 16 20 December 2000 ...
Page 626: ...Foundry Switch and Router Installation and Configuration Guide 17 52 December 2000 ...
Page 682: ...Foundry Switch and Router Installation and Configuration Guide 18 56 December 2000 ...
Page 826: ...Foundry Switch and Router Installation and Configuration Guide 20 20 December 2000 ...
Page 994: ...Foundry Switch and Router Installation and Configuration Guide 26 10 December 2000 ...
Page 1004: ...Foundry Switch and Router Installation and Configuration Guide B 6 December 2000 ...
Page 1044: ...Foundry Switch and Router Installation and Configuration Guide C 40 December 2000 ...
Page 1048: ...Foundry Switch and Router Installation and Configuration Guide D 4 December 2000 ...
Page 1070: ...Foundry Switch and Router Installation and Configuration Guide Index 18 December 2000 ...