24-21
Catalyst2950 Desktop Switch Software Configuration Guide
78-11380-05
Chapter24 Configuring Network Securi ty with ACLs Displaying ACL Information

Applying ACLs to a Physical Interface

Beginning in privileged EXEC mode, follow these steps to control access to a Layer 2 interface:
This example shows how to apply access list 2 on Gigabit Ethernet interface 0/2 to filter packets entering
the interface:
Switch(config)# interface gigabitethernet0/2
Router(config-if)# ip access-group 2 in
Note The ip access-group interface configuration command is only valid when applied to a management
interface or a Layer 2 physical interface. ACLs cannot be applied to interface port-channels.
For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL
permits the packet, the switch continues to process the packet. If the ACL rejects the packet, the switch
discards the packet.
When you apply an undefined ACL to an interface, the switch acts as if the ACL has not be en applied to
the interface and permits all packets. Remember this behavior if you use undefined ACLs for network
security.
Displaying ACL Information
You can display the ACLs that are configured on the switch, and you can display the ACLs tha t have
been applied to physical and management interfaces. This secti on consi sts of t h ese t opi cs:
•Displaying ACLs, page 24-22
•Displaying Access Groups, page 24-23
Command Purpose
Step1 configure terminal Enter global configuration mode.
Step2 interface interface-id Identify a specific interface for configuration and enter interface
configuration mode.
The interface must be a Layer 2 or management interface or a management
interface VLAN ID.
Step3 ip access-group {access-list-number |
name} {in} Control access to the specified interface.
Step4 end Return to privileged EXEC mode.
Step5 show running-config Display the access list configuration.
Step6 copy running-config startup-config (Optional) Save your entries in the configuration file.