16-30
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Configuring VACLs
•
Clearing the Edit Buffer, page 16-37
•
Removing ACEs from Security ACLs, page 16-37
•
Clearing the Security ACL Map, page 16-37
•
Displaying VACL Management Information, page 16-38
•
Capturing Traffic Flows on Specified Ports, page 16-38
•
Configuring VACL Logging, page 16-40
Creating an IP VACL and Adding ACEs
To create a new IP VACL and add ACEs, or to add ACEs to an existing IP VACL, perform these tasks
in privileged mode:
This example shows how to create an ACE for IPACL1 to allow traffic from source address 172.20.53.4:
Console> (enable)
set security acl ip IPACL1 permit host 172.20.53.4 0.0.0.0
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
Note
The example shows that because VACLs have an implicit deny feature at the end of the list,
all
other
traffic is denied.
This example shows how to create an ACE for IPACL1 to allow traffic from all source addresses:
Console> (enable)
set security acl ip IPACL1 permit any
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL1 to block traffic from source address 171.3.8.2:
Console> (enable)
set security acl ip IPACL1 deny host 171.3.8.2
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable)
show security acl info IPACL1 editbuffer
set security acl ip IPACL1
-----------------------------------------------------------------
1. permit ip host 172.20.53.4 any
2. permit ip any any
3. deny ip host 171.3.8.2 any
Console> (enable)
Task
Command
•
If an IP protocol specification is not
required, use the following syntax.
•
If an IP protocol is specified, use the
following syntax.
set security acl ip
{
acl_name
} {
permit
|
deny
} {
src_ip_spec
} [
capture
]
[
before
editbuffer_index
|
modify
editbuffer_index
] [
log
1
]
set security acl ip
{
acl_name
} {
permit
|
deny
|
redirect
mod_num/
port_num
} {
protocol
} {
src_ip_spec
} {
dest_ip_spec
} [
precedence
precedence
] [
tos
tos
] [
capture
] [
before
editbuffer_index
|
modify
editbuffer_index
] [
log
1
]
1.
The
log
keyword provides logging messages for denied IP VACLs only.
