Cisco Systems 3750E manual 34-26, Switch# show logging, Switchconfig-if#ip access-group ext1

Chapter 34 Configuring Network Security with ACLs

Configuring IPv4 ACLs

In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the web:

Switch(config)# access-list 100 remark Do not allow Winter to browse the web

Switch(config)# access-list 100 deny host 171.69.3.85 any eq www

Switch(config)# access-list 100 remark Do not allow Smith to browse the web

Switch(config)# access-list 100 deny host 171.69.3.13 any eq www

In this example of a named ACL, the Jones subnet is not allowed access:

Switch(config)# ip access-list standard prevention

Switch(config-std-nacl)#remark Do not allow Jones subnet through

Switch(config-std-nacl)#deny 171.69.0.0 0.0.255.255

In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet:

Switch(config)# ip access-list extended telnetting

Switch(config-ext-nacl)#remark Do not allow Jones subnet to telnet out

Switch(config-ext-nacl)#deny tcp 171.69.0.0 0.0.255.255 any eq telnet

ACL Logging

Two variations of logging are supported on router ACLs. The log keyword sends an informational logging message to the console about the packet that matches the entry; the log-inputkeyword includes the input interface in the log entry.

In this example, standard named access list stan1 denies traffic from 10.1.1.0 0.0.0.255, allows traffic from all other sources, and includes the log keyword.

Switch(config)# ip access-list standard stan1

Switch(config-std-nacl)#deny 10.1.1.0 0.0.0.255 log

Switch(config-std-nacl)# permit any log

Switch(config-std-nacl)# exit

Switch(config)# interface gigabitethernet1/0/1

Switch(config-if)#ip access-group stan1 in

Switch(config-if)# end

Switch# show logging

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 37 messages logged

Monitor logging: level debugging, 0 messages logged

Buffer logging: level debugging, 37 messages logged

File logging: disabled

Trap logging: level debugging, 39 message lines logged

Log Buffer (4096 bytes):

00:00:48: NTP: authentication delay calculation problems

<output truncated>

00:09:34:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet 00:09:59:%SEC-6-IPACCESSLOGS:list stan1 denied 10.1.1.15 1 packet 00:10:11:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet

This example is a named extended access list ext1 that permits ICMP packets from any source to 10.1.1.0 0.0.0.255 and denies all UDP packets.

Switch(config)# ip access-list extended ext1

Switch(config-ext-nacl)#permit icmp any 10.1.1.0 0.0.0.255 log

	Switch(config-ext-nacl)# deny udp any any log
	Switch(config-std-nacl)# exit
	Switch(config)# interface gigabitethernet1/0/2
	Switch(config-if)#ip access-group ext1 in
	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
34-26	OL-9775-02