5-7
Cisco Global Site Selector Administration Guide
OL-10410-01
Chapter 5 Configuring Access Lists and Filtering GSS Traffic
Filtering GSS Traffic Using Access Lists
Associating an Access List with a GSS Interface
After you create an access list, associate it with one or both of the GSS Ethernet
interfaces before you use the access list to filter incoming traffic received by the
interface. If no access lists are associated with an interface, the GSS allows all
incoming traffic received on that interface. After you apply an access list, the GSS
allows only the type of traffic explicitly permitted by the access list. The GSS
disallows all other traffic.
Use the
access-group
command in global configuration mode to associate an
access list with a GSS interface. You must have access to the CLI of each GSS
device to associate access lists with a GSS interface.
The syntax for the
access-group
command is as follows:
access-group
name
interface
{
eth0
|
eth1
}
The keywords and arguments are as follows:
•
name
—Name of a pre-existing access list.
•
interface
—Specifies an interface on the GSS to which the access list will be
assigned.
•
eth0
—Identifies the first Ethernet interface on the GSS device.
•
eth1
—Identifies the second Ethernet interface on the GSS device.
The GSS does not allow you to assign the same preexisting access list to both
Ethernet interfaces on the GSS device. If you attempt to use the
access-group
CLI
command to assign the same access list to Ethernet 0 and Ethernet 1, the following
error message appears:
%access-list list1 is already assigned to interface eth1.
If this error message appears, generate an identical access list for the second
Ethernet interface on the GSS device.
For example, to associate the access list named
alist1
with the first interface on
your GSS device, enter the following:
gss1.example.com#
config
gss1.example.com(config)#
access-group alist1 interface eth0
Use the
access-group
command for each access list that you want to associate
with the interface.
