1. Manuals
  2. Brands
  3. Computer Equipment
  4. Switch
  5. IBM
  6. Computer Equipment
  7. Switch

IBM 12.1(22)EA6 Including Comments About Entries in ACLs

1 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 550
Download on canonical page 550 pages, 5.74 Mb
22-16
Cisco Systems IntelligentGigabit Ethernet Switch Modules for the IBMBladeCenter, Software Configuration Guide
24R9746
Chapter22 Configuring Network Security with ACLs
Configuring ACLs
To apply a time range, you must reference it by name (for example, workhours) in an extended ACL that
can implement time ranges. This example shows how to create and verify extended access list 188 that
denies TCP traffic from any source to any destination during the defined holiday time ranges and permits
all TCP traffic during work hours.
Switch(config)# access-list 188 deny tcp any any time-range new_year_day_2000
Switch(config)# access-list 188 deny tcp any any time-range thanskgiving_2000
Switch(config)# access-list 188 deny tcp any any time-range christmas_2000
Switch(config)# access-list 188 permit tcp any any time-range workhours
Switch(config)# end
Switch# show access-lists
Extended IP access list 188
deny tcp any any time-range new_year_day_2000 (inactive)
deny tcp any any time-range thanskgiving_2000 (active)
deny tcp any any time-range christmas_2000 (inactive)
permit tcp any any time-range workhours (inactive)
This example uses named ACLs to permit and deny the same traffic.
Switch(config)# ip access-list extended deny_access
Switch(config-ext-nacl)# deny tcp any any time-range new_year_day_2000
Switch(config-ext-nacl)# deny tcp any any time-range thanksgiving_2000
Switch(config-ext-nacl)# deny tcp any any time-range christmas_2000
Switch(config-ext-nacl)# exit
Switch(config)# ip access-list extended may_access
Switch(config-ext-nacl)# permit tcp any any time-range workhours
Switch(config-ext-nacl)# end
Switch# show ip access-lists
Extended IP access list deny_access
deny tcp any any time-range new_year_day_2000 (inactive)
deny tcp any any time-range thanksgiving_2000 (inactive)
deny tcp any any time-range christmas_2000 (inactive)
Extended IP access list may_access
permit tcp any any time-range workhours (inactive)
Including Comments About Entries in ACLs
You can use the remark command to include comments (remarks) about entries in any IP standard or
extended ACL. The remarks make the ACL easier for you to understand and scan. Each remark line is
limited to 100 characters.
The remark can go before or after a permit or deny statement. You should be consistent about where you
put the remark so that it is clear which remark describes which permit or deny statement. For example,
it would be confusing to have some remarks before the associated permit or deny statements and some
remarks after the associated statements.
For IP numbered standard or extended ACLs, use the access-list access-list number remark remar k
global configuration command to include a comment about an access list. To remove the remark, use the
no form of this command.
In this example, the workstation belonging to Jones is allowed access, and the workstation belonging to
Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13
For an entry in a named IP ACL, use the remark access-list global configuration command. To remove
the remark, use the no form of this command.
In this example, the Jones subnet is not allowed to use outbound Telnet:
MENU

Models

Contents