Chapter 5
Configuring Access Lists and Filtering GSS Traffic
Associating an Access List with a GSS Interface
OL-10410-01
After you create an access list, associate it with one or both of the GSS Ethernet
interfaces before you use the access list to filter incoming traffic received by the
interface. If no access lists are associated with an interface, the GSS allows all
incoming traffic received on that interface. After you apply an access list, the GSS
allows only the type of traffic explicitly permitted by the access list. The GSS
disallows all other traffic.
Use the access-group command in global configuration mode to associate an
access list with a GSS interface. You must have access to the CLI of each GSS
device to associate access lists with a GSS interface.
The syntax for the access-group command is as follows:
access-group name interface {eth0 | eth1}
The keywords and arguments are as follows:
name—Name of a pre-existing access list.
•
interface—Specifies an interface on the GSS to which the access list will be
•
assigned.
eth0—Identifies the first Ethernet interface on the GSS device.
•
eth1—Identifies the second Ethernet interface on the GSS device.
•
The GSS does not allow you to assign the same preexisting access list to both
Ethernet interfaces on the GSS device. If you attempt to use the access-group CLI
command to assign the same access list to Ethernet 0 and Ethernet 1, the following
error message appears:
%access-list list1 is already assigned to interface eth1.
If this error message appears, generate an identical access list for the second
Ethernet interface on the GSS device.
For example, to associate the access list named alist1 with the first interface on
your GSS device, enter the following:
gss1.example.com# config
gss1.example.com(config)# access-group alist1 interface eth0
Use the access-group command for each access list that you want to associate
with the interface.
Filtering GSS Traffic Using Access Lists
Cisco Global Site Selector Administration Guide
5-7