25-25
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 25 Configuring Network Securi t y w it h ACLs Examples for Compiling ACLs

Numbered ACL Examples

This example shows that the switch accepts addresses on network 36.0.0.0 subnets and denies all packets
coming f rom 56.0 .0. 0 subn ets. T he ACL is th en a pplied t o pa c kets e nter ing G igabit Et herne t i n terface
0/1.
Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255
Switch(config)# access-list 2 deny 56.0.0.0 0.255.255.255
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 2 in

Extended ACL Examples

In thi s example of using an extended ACL, you have a network connected to the Int ernet, an d you want
any host on the network to be able to form TCP T elnet and SMTP connections to any host on the Internet.
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 23
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 25
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group 102 in
SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The
same po rt n um ber s are used t h rougho ut the li fe of the conn ec ti on. M a il pa ckets co ming i n fr om th e
Internet have a destination port of 25. Because the secure system behind the switch always accepts mail
connec tions on por t 25, the i ncoming service s are cont rolled.

Named ACL Example

The Marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard
171.6 9.0.0 0.0. 255.255 and denies any other TC P traffic. It permit s any other IP traffic.
Switch(config)# ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit ip any any
The ACLs are ap pl ied to pe rm it G igabi t E the rne t p ort 0/ 1, w hic h i s co nfigured as a L a yer 2 p ort , w it h
the M arketi ng_ group ACL applie d t o in com ing tra ffic.
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip access-group marketing_group in
...

Commen ted IP ACL En try Exam ples

In this example of a numbered AC L, the workstation belonging to Jones is allowed access, and the
workstation belonging to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstation through
Switch(config)# access-list 1 deny 171.69.3.13