Cisco IE 4000, Руководство по настройке программного обеспечения

Страница: 554 / 1066

550
Configuring Network Security with ACLs
Information About Network Security with ACLs

Authentication Header Protocol ( ahp )

Enhanced Interior Gateway Routing Protocol ( eigrp)

Encapsulation Security Payload ( esp )

generic routing encapsulation ( gre )

Internet Control Message Protocol ( icmp)

Internet Group Management Protocol ( igmp )

any Interior Protocol ( ip )

IP in IP tunneling ( ipinip )

KA9Q NOS-compatible IP over IP tunneling ( nos )

Open Shortest Path First routing ( ospf )

Payload Compression Protocol ( pcp )

Protocol Independent Multicast ( pim )

Transmission Control Protocol ( tcp )

User Datagram Protocol ( udp )
Note: ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered.
Note: The switch does not support dynamic or reflexive access lists. It also does not support filtering based on the type
of service (ToS) minimize-monetary-cost bit.
Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP.
After an ACL is created, any additions (possibly entered from the terminal) are placed at the end of the list. You cannot
selectively add or remove access list entries from a numbered access list.
Note: When you are creating an ACL, remember that, by default, the end of the access list contains an implicit deny
statement for all packets if it did not find a match before reaching the end.
After creating a numbered extended ACL, you can apply it to terminal lines (see Applying an IPv4 ACL to a Terminal Line,
page 560 ), to interfaces (see Applying an IPv4 ACL to an Interface, page 560 ), or to VLANs (see Monitoring and
Maintaining Network Security with ACLs, page 562 ).
Resequencing ACEs in an ACL
Sequence numbers for the entries in an access list are automatically generated when you create a new ACL. You can
use the
ip access-list resequence global configuration command to edit the sequence numbers in an ACL and change
the order in which ACEs are applied. For example, if you add a new ACE to an ACL, it is placed at the bottom of the list.
By changing the sequence number, you can move the ACE to a different position in the ACL.
Named Standard and Extended ACLs
You can identify IPv4 ACLs with an alphanumeric string (a name) rather than a number. You can use named ACLs to
configure more IPv4 access lists in a router than if you were to use numbered access lists. If you identify your access list
with a name rather than a number, the mode and command syntax are slightly different. However, not all commands that
use IP access lists accept a named access list.
Note: The name you give to a standard or extended ACL can also be a number in the supported range of access list
numbers. That is, the name of a standard IP ACL can be 1 to 99; the name of an extended IP ACL can be 100 to 199.
The advantage of using named ACLs instead of numbered lists is that you can delete individual entries from a named list.