Brocade Communications Systems 6650 manual Configuration examples for extended numbered ACLs

Extended numbered ACL configuration

Configuration examples for extended numbered ACLs

To configure an extended access control list that blocks all Telnet traffic received on port 1/1/1 from IP host 10.157.22.26, enter the following commands.

Brocade(config)# access-list 101 deny tcp host 10.157.22.26 any eq telnet log Brocade(config)# access-list 101 permit ip any any

Brocade(config)# interface ethernet 1/1/1 Brocade(config-if-e10000-1/1/1)# ip access-group 101 in Brocade(config)# write memory

Here is another example of commands for configuring an extended ACL and applying it to an interface. These examples show many of the syntax choices. Notice that some of the entries are configured to generate log entries while other entries are not thus configured.

Brocade(config)# access-list 102 perm icmp 10.157.22.0/24 209.157.21.0/24 Brocade(config)# access-list 102 deny igmp host rkwong 10.157.21.0/24 log Brocade(config)# access-list 102 deny igrp 10.157.21.0/24 host rkwong log Brocade(config)# access-list 102 deny ip host 10.157.21.100 host 10.157.22.1 log Brocade(config)# access-list 102 deny ospf any any log

Brocade(config)# access-list 102 permit ip any any

The first entry permits ICMP traffic from hosts in the 10.157.22.x network to hosts in the 10.157.21.x network.

The second entry denies IGMP traffic from the host device named “rkwong” to the 10.157.21.x network.

The third entry denies IGMP traffic from the 10.157.21.x network to the host device named “rkwong”.

The fourth entry denies all IP traffic from host 10.157.21.100to host 10.157.22.1 and generates syslog entries for packets that are denied by this entry.

The fifth entry denies all OSPF traffic and generates syslog entries for denied traffic.

The sixth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.

The following commands apply ACL 102 to the incoming traffic on port 1/1/2 and to the incoming traffic on port 1/3/1.

Brocade(config)# interface ethernet 1/1/2

Brocade(config-if-e10000-1/1/2)# ip access-group 102 in

Brocade(config-if-e10000-1/1/2)# exit

Brocade(config)# interface ethernet 1/3/1

Brocade(config-if-e10000-1/3/1)# ip access-group 102 in

Brocade(config)# write memory

Here is another example of an extended ACL.

Brocade ICX 6650 Security Configuration Guide	95
53-1002601-01