Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1647 / 2086

62-23
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring VLAN Maps
You can use the no vlan access-map name global configuration command to delete a map. You can use
the no vlan access-map name number global configuration command to delete a single sequence entry
from within the map. You can use the no action access-map configuration command to enforce the
default action, which is to forward.
VLAN maps do not use the specific permit or deny keywords. To deny a packet by using VLAN maps,
create an ACL that would match the packet, and then set the action to drop. A permit in the ACL is the
same as a match. A deny in the ACL means no match.
Examples of ACLs and VLAN Maps
These examples show how to create ACLs and VLAN maps for specific purposes.
Example 1
This example shows how to create an ACL and a VLAN map to deny a packet. In the first map, any
packets that match the
ip1 ACL (TCP packets) would be dropped. You first create the ip1 ACL to permit
any TCP packet and no other packets. Because there is a match clause for IP packets in the VLAN map,
the default action is to drop any IP packet that does not match any of the match clauses.
Switch(config)# ip access-list extended ip1
Switch(config-ext-nacl)# permit tcp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 10
Switch(config-access-map)# match ip address ip1
Switch(config-access-map)# action drop
This example shows how to create a VLAN map to permit a packet. ACL ip2 permits UDP packets; and
any packets that match the ip2 ACL are forwarded.
Switch(config)# ip access-list extended ip2
Switch(config-ext-nacl)# permit udp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 20
Switch(config-access-map)# match ip address ip2
Switch(config-access-map)# action forward
In this map, any IP packets that did not match any of the previous ACLs (that is, packets that are not TCP
packets or UDP packets) would get dropped.
Step 4
Switch(config-access-map)# match { ip |
ipv6 | mac } address { name | number } [ name
| number ]
Matches the packet (using either the IP, IPv6, or MAC address)
against one or more standard or extended access lists. Note that
packets are matched only against access lists of the correct
protocol type. IP packets are compared with standard or extended
IP access lists. Non-IP packets are only compared with named
MAC extended access lists. If a match clause is not specified, the
action is taken on all packets.
Step 5
Switch(config-access-map)# end Returns to global configuration mode.
Step 6
Switch(config)# show running-config
Displays the access list configuration.
Step 7
Switch(config)# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose