Elastic Networks BitStorm L3S-T, Руководство пользователя, Страница: 86 / 167

IP Filtering
Command Line
IP Filtering blocks traffic leaving the Switch based on a destination IP address. This is useful when you want to
restrict certain users or subnets from gaining access to other locations such as certain websites or network
segments.
Configuration Steps
To set up IP Filtering, you first create an
access list
or filtering entry that specifies whether traffic to a specific IP
address is permitted or not. Next, you assign these filtering entries to specific ports by creating an
access
group
.
Important:
Access lists are applied to single Gigabit ports.
●
Access lists are applied to a group of eight Fast Ethernet ports.
●
Create IP filtering entries using this command:
>[no] access-list <number> <permit | deny> <ip_address> <mask> out
[no]
deletes an existing access list
<number>
is any number from 1 - 99 that you assign to identify this access list entry
<permit | deny>
permit means forward traffic to the destination IP address, deny means drop all traffic to
this address
<ip_address> <mask>
is the IP address and subnet mask of the destination
1.
To see your entries, type:
>show access-list
2.
Set ports to apply these filtering entries using this command:
>[no] access-group <port_group> <access_list_number>
[no]
deletes an existing access list for a port or port group
<port_group>
for Fast Ethernet ports is a specific range of eight numbers, 1-8, 9-16, 17-24, etc. These
numbers must be entered in exactly the same port groups that exist on the switch. For Gigabit ports, enter
the port number.
<access_list_number>
the number you assigned to the access list in Step 1
3.
To see your entries, type:
>show access-group
4.
86