In this example, the workstation that belongs to Jones is allowed access, and the workstation that belongs to
Smith is not allowed access:
Switch(config)#
access-list 1 remark Permit only Jones workstation through
Switch(config)#
access-list 1 permit 171.69.2.88
Switch(config)#
access-list 1 remark Do not allow Smith through
Switch(config)#
access-list 1 deny 171.69.3.13
For an entry in a named IP ACL, use the
remark
access-list configuration command. To remove the remark,
use the
no
form of this command.
In this example, the Jones subnet is not allowed to use outbound Telnet:
Switch(config)#
ip access-list extended telnetting
Switch(config-ext-nacl)#
remark Do not allow Jones subnet to telnet out
Switch(config-ext-nacl)#
deny tcp host 171.69.2.88 any eq telnet
Examples: Troubleshooting ACLs
If this ACL manager message appears and [chars] is the access-list name,
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The switch has insufficient resources to create a hardware representation of the ACL. The resources include
hardware memory and label space but not CPU memory. A lack of available logical operation units or
specialized hardware resources causes this problem. Logical operation units are needed for a TCP flag match
or a test other than
eq
(
ne
,
gt
,
lt
, or
range
) on TCP, UDP, or SCTP port numbers.
Use one of these workarounds:
•
Modify the ACL configuration to use fewer resources.
•
Rename the ACL with a name or number that alphanumerically precedes the ACL names or numbers.
To determine the specialized hardware resources, enter the
show platform layer4 acl
map privileged EXEC
command. If the switch does not have available resources, the output shows that index 0 to index 15 are not
available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug Toolkit.
For example, if you apply this ACL to an interface:
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
permit tcp source source-wildcard destination destination-wildcard
And if this message appears:
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The flag-related operators are not available. To avoid this issue,
•
Move the fourth ACE before the first ACE by using
ip access-list resequence
global configuration
command:
permit tcp source source-wildcard destination destination-wildcard
permit tcp source source-wildcard destination destination-wildcard range 5 60
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01
181
Configuring IPv4 ACLs
Examples: Troubleshooting ACLs