Brocade Communications Systems 6650 manual Configuring standard numbered ACLs

Configuring standard numbered ACLs

•You can apply an ACL to a port that has TCP SYN protection or ICMP smurf protection, or both, enabled.

Configuring standard numbered ACLs

This section describes how to configure standard numbered ACLs with numeric IDs and provides configuration examples.

Standard ACLs permit or deny packets based on source IP address. You can configure up to 99 standard numbered ACLs. There is no limit to the number of ACL entries an ACL can contain except for the system-wide limitation. For the number of ACL entries supported on a device, refer to “ACL IDs and entries” on page 83.

Standard numbered ACL syntax

Syntax: [no] access-list ACL-numdeny permit source-iphostname wildcard [log]

or

Syntax: [no] access-list ACL-numdeny permit source-ip/mask-bitshostname [log]

Syntax: [no] access-list ACL-numdeny permit host source-iphostname [log]

Syntax: [no] access-list ACL-numdeny permit any [log]

Syntax: [no] ip access-group ACL-numin out

The ACL-numparameter is the access list number from 1–99.

The deny permit parameter indicates whether packets that match a policy in the access list are denied (dropped) or permitted (forwarded).

The source-ipparameter specifies the source IP address. Alternatively, you can specify the host name.

NOTE

To specify the host name instead of the IP address, the host name must be configured using the DNS resolver on the Brocade device. To configure the DNS resolver name, use the ip dns server-address… command at the global CONFIG level of the CLI.

The wildcard parameter specifies the mask value to compare against the host address specified by the source-ipparameter. The wildcard is in dotted-decimal notation (IP address format). It is a four-part value, where each part is 8 bits (one byte) separated by dots, and each bit is a one or a zero. Each part is a number ranging from 0 to 255, for example 0.0.0.255. Zeros in the mask mean the packet source address must match the source-ip.Ones mean any value matches. For example, the source-ipand wildcard values 10.157.22.26 0.0.0.255 mean that all hosts in the Class A subnet 10.157.22.x match the policy.

If you prefer to specify the wildcard (mask value) in CIDR format, you can enter a forward slash after the IP address, then enter the number of significant bits in the mask. For example, you can enter the CIDR equivalent of “10.157.22.26 0.0.0.255” as “10.157.22.26/24”. The CLI automatically converts the CIDR number into the appropriate ACL mask (where zeros instead of ones are the

86	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01