24-6
Catalyst2950 Desktop Switch Software Configuration Guide
78-11380-05
Chapter24 Configuring Network Security with ACLs
Configuring ACLs

Guidelines for Applying ACLs to Physical Interfaces

When applying ACLs to physical interfaces, follow these configuration guidelines:
•Only one ACL can be attached to an interface. For more information, refer to the ip access-group
interface command in the command reference for this release.
•All ACEs in an ACL must have the same user -defined m ask. Ho weve r , A CEs can ha ve d ifferent rules
that use the same mask. On a given interface, only one type of user-defined mask is allo wed, b ut you
can apply any number of system-defined masks. For more information on system-defined masks, see
the “Understanding Access Control Parameters” section on page 24-4.
This example shows the same mask in an ACL:
Switch (config)#ip access-list extended acl2
Switch (config-ext-nacl)# permit tcp 10.1.1.1 0.0.0.0 any eq 80
Switch (config-ext-nacl)# permit tcp 20.1.1.1 0.0.0.0 any eq 23
In this example, the first ACE permits all the TCP packets coming from host 10.1.1.1 with a
destination TCP port number of 80. The second ACE permits all TCP packet s com ing fro m host
20.1.1.1 with a destination TCP port number of 23. Both the ACEs use the same mask; t he refore, a
switch supports this ACL.
•When you apply an ACL to a physical interface, some keywords are not supported and certain mask
restrictions apply to the ACLs. See the “Creating a Numbered Standard ACL” section on page 24-9
and the “Creating a Numbered Extended ACL” section on page24-10 for creating these ACLs.
Note You can also apply ACLs to a man agement interf ace without the ab ove limita tions. Fo r informati on, refer
to the “Configuring IP Services” section of the Cisco IOS IP and IP Routing Configuration Guide and
the Command Reference for IOS Release 12.1.
Configuring ACLs
This section includes these top ics :
•“Unsupported Features” section on page 24-7
•“Creating Standard and Extended IP ACLs” section on page 24-7
•“Creating Named MAC Extended ACLs” section on page 24-18
•“Creating MAC Access Groups” section on page24-19
Configuring ACLs on a Layer 2 interface is the same as configuring ACLs on Cisco routers. The process
is briefly described here. For more detailed information about co nfigurin g route r ACLs, refer to t he
“Configuring IP Services” chapter in the Cisco IP and IP Routing Configuration Guide for IOS
Release12.1. For detailed information about the commands, refer to the Cisco IOS IP and IP Routing
Command Reference for IOS Release 12.1 . For a list of IOS features not supported on the switch, see the
“Unsupported Features” section on page 24-7.