Cisco Systems 520 series Configure Access Lists, Creates an access list which prevents Internet

Chapter 8 Configuring a Simple Firewall

Configure Access Lists

Note The procedures in this chapter assume that you have already configured basic router features as well as PPPoE or PPPoA with NAT. If you have not performed these configurations tasks, see Chapter 1, “Basic Router Configuration,” Chapter 3, “Configuring PPP over Ethernet with NAT,” and Chapter 4, “Configuring PPP over ATM with NAT,” as appropriate for your router. You may have also configured DHCP, VLANs, and secure tunnels.

Configure Access Lists

Perform these steps to create access lists for use by the firewall, beginning in global configuration mode:

	Command			Purpose
Step 1
	access-list access-list-number{deny permit}			Creates an access list which prevents Internet-
	protocol source source-wildcard [operator [port]]			initiated traffic from reaching the local (inside)
	destination			network of the router, and which compares
				source and destination ports.
	Example:			See the Cisco IOS IP Command Reference,
	Router(config)# access-list 103 deny ip any			Volume 1 of 4: Addressing and Services for
	any			details about this command.
	Router(config)# access-list 103 permit host
	200.1.1.1 eq isakmp any
	Router(config)#
Step 2
	access-list access-list-number{deny permit}			Creates an access list that allows network traffic
	protocol source source-wildcard destination			to pass freely between the corporate network
	destination-wildcard			and the local networks through the configured
				VPN tunnel.
	Example:
	Router(config)# access-list 105 permit ip
	10.1.1.0 0.0.0.255	192.168.0.0	0.0.255.255
	Router(config)#

Cisco Secure Router 520 Series Software Configuration Guide

OL-14210-01 8-3