Brocade Communications Systems 6650 manual Extended named ACL configuration

Extended named ACL configuration

Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24 Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 eq ftp 10.157.22.0/24 Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24 lt telnet neq 5

Brocade(config)# access-list 103 deny udp any range 5 6 10.157.22.0/24 range 7 8 Brocade(config)# access-list 103 permit ip any any

The first entry in this ACL denies TCP traffic from the 10.157.21.x network to the 10.157.22.x network.

The second entry denies all FTP traffic from the 10.157.21.x network to the 10.157.22.x network.

The third entry denies TCP traffic from the 10.157.21.x network to the 10.157.22.x network, if the TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and if the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than 23 are allowed.

The fourth entry denies UDP packets from any source to the 10.157.22.x network, if the UDP port number from the source network is 5 or 6 and the destination UDP port is 7 or 8.

The fifth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.

The following commands apply ACL 103 to the incoming traffic on ports 1/2/1 and 1/2/2.

Brocade(config)# interface ethernet 1/2/1

Brocade(config-if-e10000-1/2/1)# ip access-group 103 in

Brocade(config-if-e10000-1/2/1)# exit

Brocade(config)# interface ethernet 1/2/2

Brocade(config-if-e10000-1/2/2)# ip access-group 103 in

Brocade(config)# write memory

Extended named ACL configuration

The commands for configuring named ACL entries are different from the commands for configuring numbered ACL entries. The command to configure a numbered ACL is access-list. The command for configuring a named ACL is ip access-list. In addition, when you configure a numbered ACL entry, you specify all the command parameters on the same command. When you configure a named ACL, you specify the ACL type (standard or extended) and the ACL number with one command, which places you in the configuration level for that ACL. Once you enter the configuration level for the ACL, the command syntax is the same as the syntax for numbered ACLs.

Extended ACLs let you permit or deny packets based on the following information:

•IP protocol

•Source IP address or host name

•Destination IP address or host name

•Source TCP or UDP port (if the IP protocol is TCP or UDP)

•Destination TCP or UDP port (if the IP protocol is TCP or UDP)

The IP protocol can be one of the following well-known names or any IP protocol number from 0 – 255:

96	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01