Brocade Communications Systems 6650 manual Extended numbered ACL configuration

Extended numbered ACL configuration

Configuration example for standard named ACLs

To configure a standard named ACL, enter commands such as the following.

Brocade(config)# ip access-list standard Net1

Brocade(config-std-nACL)# deny host 10.157.22.26 log

Brocade(config-std-nACL)# deny 10.157.29.12 log

Brocade(config-std-nACL)# deny host IPHost1 log

Brocade(config-std-nACL)# permit any

Brocade(config-std-nACL)# exit

Brocade(config)# int ethernet 1/1/1

Brocade(config-if-e10000-1/1/1)# ip access-group Net1 in

The commands in this example configure a standard ACL named “Net1”. The entries in this ACL deny packets from three source IP addresses from being forwarded on port 1. Since the implicit action for an ACL is “deny”, the last ACL entry in this ACL permits all packets that are not explicitly denied by the first three ACL entries. For an example of how to configure the same entries in a numbered ACL, refer to “Configuring standard numbered ACLs” on page 86.

Notice that the command prompt changes after you enter the ACL type and name. The “std” in the command prompt indicates that you are configuring entries for a standard ACL. For an extended ACL, this part of the command prompt is “ext“. The “nACL” indicates that you are configuring a named ACL.

Extended numbered ACL configuration

This section describes how to configure extended numbered ACLs.

Extended ACLs let you permit or deny packets based on the following information:

•IP protocol

•Source IP address or host name

•Destination IP address or host name

•Source TCP or UDP port (if the IP protocol is TCP or UDP)

•Destination TCP or UDP port (if the IP protocol is TCP or UDP)

The IP protocol can be one of the following well-known names or any IP protocol number from 0 – 255:

•Internet Control Message Protocol (ICMP)

•Internet Group Management Protocol (IGMP)

•Internet Gateway Routing Protocol (IGRP)

•Internet Protocol (IP)

•Open Shortest Path First (OSPF)

•Transmission Control Protocol (TCP)

•User Datagram Protocol (UDP)

For TCP and UDP, you also can specify a comparison operator and port name or number. For example, you can configure a policy to block web access to a specific website by denying all TCP port 80 (HTTP) packets from a specified source IP address to the website IP address.

90	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01