Cisco MWR 1941-DC - 1941 Mobile Wireless Router, Руководство по настройке программного обеспечения

Страница: 168 / 184

6-60
Cisco MWR 1941-DC Mobile Wireless Edge Router Software Configuration Guide
OL-11503-01
Chapter 6 Configuring the MWR 1941-DC in a Cell Site DCN
Filtering IP Packets Using Access Lists
Configuration Examples
The following are access list configuration examples.
Numbered Access List Examples
In the following example, network 36.0.0.0 is a Class A network whose second octet specifies a subnet;
that is, its subnet mask is 255.255.0.0. The third and fourth octets of a network 36.0.0.0 address specify
a particular host. Using access list 2, the Cisco IOS software would accept one address on subnet 48 and
reject all others on that subnet. The last line of the list shows that the software would accept addresses
on all other network 36.0.0.0 subnets.
access-list 2 permit 36.48.0.3
access-list 2 deny 36.48.0.0 0.0.255.255
access-list 2 permit 36.0.0.0 0.255.255.255
interface ethernet 0
ip access-group 2 in
The following example defines access lists 1 and 2, both of which have logging enabled:
interface ethernet 0
ip address 1.1.1.1 255.0.0.0
ip access-group 1 in
ip access-group 2 out
!
access-list 1 permit 5.6.0.0 0.0.255.255 log
access-list 1 deny 7.9.0.0 0.0.255.255 log
!
access-list 2 permit 1.2.3.4 log
access-list 2 deny 1.2.0.0 0.0.255.255 log
If the interface receives 10 packets from 5.6.7.7 and 14 packets from 1.2.23.21, the first log will look
like the following:
list 1 permit 5.6.7.7 1 packet
list 2 deny 1.2.23.21 1 packet
Five minutes later, the console will receive the following log:
list 1 permit 5.6.7.7 9 packets
list 2 deny 1.2.23.21 13 packets
Turbo Access Control List Example
The following is a Turbo ACL configuration example. The access-list compiled global configuration
command output indicates that Turbo ACL is enabled.
interface Ethernet2/7
no ip address
ip access-group 20 out
no ip directed-broadcast
shutdown
!
no ip classless
ip route 192.168.0.0 255.255.255.0 10.1.1.1
!
access-list compiled
access-list 1 deny any
access-list 2 deny 192.168.0.0 0.0.0.255
access-list 2 permit any