34-11
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
Chapter34 Configuring Network Securi ty with ACLs Configuring IPv4 ACLs
The switch always rewrites the order of standard access lists so that entries with host matches and entries
with matches having a don’t care mask of 0.0.0.0 are moved to the top of the list, above any entries with
non-zero don’t care masks. Therefore, in show command output and in the configuration file, the ACEs
do not necessarily appear in the order in which they were entered.
After creating a numbered standard IPv4 ACL, you can apply it to terminal lines (se e the “Applying an
IPv4 ACL to a Terminal Line” section on page 34-19), to interfaces (see the “Applying an IPv4 ACL to
an Interface” section on page 34-20), or to VLANs (see the “Configuring VLAN Maps” section on
page 34-30).
Creating a Numbered Extended ACL
Although standard ACLs use only source addresses for matching, you can use extend ed ACL source and
destination addresses for matching operations and optional prot ocol ty pe inf orm ation f or finer
granularity of control. When you are creating ACEs in numbered extended access lists, remember that
after you create the ACL, any additions are placed at the end of the list. You cannot reorder the list or
selectively add or remove ACEs from a numbered list.
Some protocols also have specific parameters and keywords that apply to that protocol .
These IP protocols are supported (protocol keywords are in parentheses in bold):
Authentication Header Protocol (ahp), Enhanced Interior Gateway Routing Protocol (eigrp),
Encapsulation Security Payload (esp), generic routing encapsulation (gre), Internet Control Message
Protocol (icmp), Internet Group Management Protocol (igmp), any Interior Protocol (ip), IP in IP
tunneling (ipinip), KA9Q NOS-compatible IP over IP tunneling (nos), Open Shortest Path First routing
(ospf), Payload Compression Protocol (pcp), Protocol-Independent Multicas t ( pim), Transmission
Control Protocol (tcp), or User Datagram Protocol (udp).
Note ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered.
For more details on the specific keywords for each protocol, see these command references:
•Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2
•Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols, Release 12.2
•Cisco IOS IP Command Reference, Volume 3 of 3: Multicast, Release 12.2
Note The switch does not support dynamic or reflexive access lists. It also does not sup port filtering based on
the type of service (ToS) minimize-monetary-cost bit.
Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP.