Cisco IE 4000, Руководство по настройке программного обеспечения

Страница: 556 / 1066

552
Configuring Network Security with ACLs
Information About Network Security with ACLs
IPv4 ACL to a Terminal Line
You can use numbered ACLs to control access to one or more terminal lines. You cannot apply named ACLs to lines. You
must set identical restrictions on all the virtual terminal lines because a user can attempt to connect to any of them.
For procedures for applying ACLs to interfaces, see Applying an IPv4 ACL to an Interface, page 560 . For applying ACLs
to VLANs, see Monitoring and Maintaining Network Security with ACLs, page 562 .
IPv4 ACL Application to an Interface Guidelines

Apply an ACL only to inbound Layer 2 ports.

Apply an ACL to either outbound or inbound Layer 3 interfaces.

When controlling access to an interface, you can use a named or numbered ACL.

If you apply an ACL to a port that is a member of a VLAN, the port ACL takes precedence over an ACL applied to
the VLAN interface.

If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes precedence over
an input Layer 3 ACL applied to the VLAN interface. The port ACL always filters incoming packets received on the
Layer 2 port.

If you apply an ACL to a Layer 3 interface and routing is not enabled, the ACL only filters packets that are intended
for the CPU, such as SNMP, Telnet, or web traffic. You do not have to enable routing to apply ACLs to Layer 2
interfaces.

When private VLANs are configured, you can apply router ACLs only on the primary-VLAN SVIs. The ACL is applied
to both primary and secondary VLAN Layer 3 traffic.
Note: By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a packet is
denied by an access group. These access-group denied packets are not dropped in hardware but are bridged to the
switch CPU so that it can generate the ICMP-unreachable message. Port ACLs are an exception. They do not generate
ICMP unreachable messages.
ICMP unreachable messages can be disabled on router ACLs with the no ip unreachables interface command.
For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL permits the packet,
the switch continues to process the packet. If the ACL rejects the packet, the switch discards the packet.
For outbound ACLs, after receiving and sending a packet to a controlled interface, the switch checks the packet against
the ACL. If the ACL permits the packet, the switch sends the packet. If the ACL rejects the packet, the switch discards
the packet.
By default, the input interface sends ICMP Unreachable messages whenever a packet is discarded, regardless of whether
the packet was discarded because of an ACL on the input interface or because of an ACL on the output interface. ICMP
Unreachables are normally limited to no more than one every one-half second per input interface, but this can be
changed by using the
ip icmp rate-limit unreachable global configuration command.
When you apply an undefined ACL to an interface, the switch acts as if the ACL has not been applied to the interface
and permits all packets. Remember this behavior if you use undefined ACLs for network security.
Hardware and Software Handling of IP ACLs
ACL processing is primarily accomplished in hardware, but requires forwarding of some traffic flows to the CPU for
software processing. If the hardware reaches its capacity to store ACL configurations, packets are sent to the CPU for
forwarding. The forwarding rate for software-forwarded traffic is substantially less than for hardware-forwarded traffic.