Table of Contents
Advertisement
Chapter 15
Configuring Access Control
Because the VACLs have an implicit deny feature at the end of the list, all other traffic is denied.
Note
This example shows how to create an ACE for IPACL1 to allow the traffic from all source addresses:
Console> (enable) set security acl ip IPACL1 permit any
IPACL1 editbuffer modified. Use 'commit' command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL1 to block the traffic from source address 171.3.8.2:
Console> (enable) set security acl ip IPACL1 deny host 171.3.8.2
IPACL1 editbuffer modified.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable) show security acl info IPACL1 editbuffer
set security acl ip IPACL1
-----------------------------------------------------------------
1. permit ip host 172.20.53.4 any
2. permit ip any any
3. deny ip host 171.3.8.2 any
Console> (enable)
This example shows how to commit the ACEs to NVRAM:
Console> (enable) commit security acl all
ACL commit in progress.
ACL IPACL1 is committed to hardware.
Console> (enable)
Note
For more information about the commit security acl all command, see the
on page
Enter the show security acl info IPACL1 command to verify that the changes were committed. If this
VACL has not been mapped to a VLAN, enter the set security acl map command to map it to a VLAN.
This example shows how to create an ACE for IPACL2 to block the traffic from source address
172.20.3.2 and place this ACE before ACE number 2 in the VACL. Optionally, you can enter the modify
keyword to replace an existing ACE with a new ACE. Enter the show security acl info acl_name
[editbuffer] command to see the current ACE listing that is stored in NVRAM (enter the editbuffer
keyword to see edit buffer contents).
Console> (enable) set security acl ip IPACL2 deny host 172.20.3.2 before 2
IPACL2 editbuffer modified. Use 'commit' command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL2 to redirect IP traffic to port 3/1 from source
address 1.2.3.4 with the destination address of 255.255.255.255. The host can be used as an abbreviation
for a source and source-wildcard of 0.0.0.0. This ACE also specifies the following:
precedence—IP precedence values that range between zero for low priority and seven for high
•
priority.
•
tos—Type of service levels that range between 0 and 15.
The ToS values are bits 3 through 6 of the IP ToS byte as defined by RFC 1349. The precedence values are
Note
bits 0 through 2 as defined by RFC 791.
OL-8978-04
Use 'commit' command to apply changes.
15-53.
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
Configuring VACLs
"Committing ACLs" section
15-49
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
