16-32
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Configuring VACLs
ACL IPACL2 is committed to hardware.
Console> (enable)
Note
For more information about the
commit security acl all
command see the
“Committing ACLs”
section on page 16-35
.
Enter the
show security acl info IPACL2
command to verify that the changes were committed. If this
VACL has not been mapped to a VLAN, enter the
set security acl map
command to map it to a VLAN.
Creating an IPX VACL and Adding ACEs
To create a new IPX VACL and add ACEs, or to add ACEs to an existing IPX VACL, perform this task
in privileged mode:
This example shows how to create an ACE for IPXACL1 to block all traffic from source network 1234:
Console> (enable)
set security acl ipx IPXACL1 deny any 1234
IPXACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPXACL1 to block all traffic with destination address
1.A.3.4:
Console> (enable)
set security acl ipx IPXACL1 deny any any 1.A.3.4
IPXACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPXACL1 to redirect broadcast traffic to port 4/1 from
source network 3456:
Console> (enable)
set security acl ipx IPXACL1 redirect 4/1 any 3456
IPXACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable)
show security acl info IPXACL1 editbuffer
set security acl ipx IPXACL1
-----------------------------------------------------------------
1. deny any 1234
2. deny any any 1.A.3.4
3. redirect 4/1 any 3456
Console> (enable)
Note
For more information about the
show security acl info
command, see the
“Showing the Contents of
a VACL” section on page 16-36
.
Task
Command
Create a new IPX VACL and add
ACEs, or add ACEs to an existing
IPX VACL.
set security acl ipx
{
acl_name
} {
permit
|
deny
|
redirect
mod_num/port_num
} {
protocol
} {
src_net
}
[
dest_net.
[
dest_node
] [[
dest_net_mask.
]
dest_node_mask
]]
[
capture
]
[
before
editbuffer_index
modify
editbuffer_index
]
