5-9
Cisco Global Site Selector Administration Guide
OL-10410-01
Chapter 5 Configuring Access Lists and Filtering GSS Traffic
Filtering GSS Traffic Using Access Lists
Removing Rules from an Access List
Access lists must contain at least one rule. Removing the last rule from an access
list removes the list itself from the GSS. To remove a rule from an existing access
list, use the
no
form of the
access-list
command in global configuration mode.
For example, to remove the rule from the access list named
alist1
that blocks all
traffic from host 192.168.1.101, enter:
gss1.example.com#
config
gss1.example.com(config)#
no access-list alist1 deny tcp host
192.168.1.101
See the
“Creating an Access List”
section for an explanation of
access-list
command syntax.
Use the
show access-list
command to verify that the rule has been removed from
your access list.
gss1.example.com(config)#
show access-list
access-list:alist1
access-list alist1 permit tcp any destination-port eq 443
Segmenting GSS Traffic by Ethernet Interface
By default, the GSS devices listen for DNS traffic on both GSS Ethernet
interfaces, 0 and 1. In the case of inter-GSS communications, GSS devices listen
for configuration and status updates on one interface only. Ethernet interface 0 is
the default.
To reconfigure which interface is used for inter-GSS communications on the GSS
network, use the
gss-communications
command. See the
Cisco Global Site
Selector Getting Started Guide
for details.
For security reasons you can limit GSS traffic to one Ethernet interface, or
segment traffic by constraining a certain type of traffic on a designated interface.
By using the
access-list
and
access-group
commands discussed previously, you
can define access lists that limit traffic on either of the two GSS Ethernet
interfaces.
