37-6
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 37 Configuring Network Security with ACLs
Information About Network Security with ACLs
Note In addition to numbered standard and extended ACLs, you can also create standard and extended named
IP ACLs by using the supported numbers. That is, the name of a standard I P ACL can be 1 to 99; the
name of an extended IP ACL can be 100 to 199. The advantage of using named ACLs instead of
numbered lists is that you can delete individual entries from a named list.
ACL Logging
The switch software can provide logging messages about packets permitted or denied by a standard IP
access list. That is, any packet that matches the ACL causes an informational logging message about the
packet to be sent to the console. The level of messages logged to the console is controlled by the logging
console commands controlling the syslog messages.
Note Because routing is done in hardware and logging is done in software, if a large number of packet s match
a permit or deny ACE containing a log keyword, the software might not be able to match the hardware
processing rate, and not all packets will be logged.
The first packet that triggers the ACL causes a logging message right away, and subsequent packets are
collected over 5-minute intervals before they appear or logged. The logging message includes the a ccess
list number, whether the packet was permitted or denied, the source IP address of the packet, and the
number of packets from that source permitted or denied in the prior 5-minute interval.
Numbered Extended ACL
Although standard ACLs use only source addresses for matching, you can use extend ed ACL source and
destination addresses for matching operations and optional pr otocol type information for finer
granularity of control. When you are creating ACEs in numbered extended access lists, remember that
after you create the ACL, any additions are placed at the end of the list. You cannot reorder the list or
selectively add or remove ACEs from a numbered list.
Some protocols also have specific parameters and keywords that apply to that protocol .
These IP protocols are supported (protocol keywords are in parentheses in bold):
• Authentication Header Protocol (ahp)
• Enhanced Interior Gateway Routing Protocol (eigrp)
• Encapsulation Security Payload (esp)
• generic routing encapsulation (gre)
• Internet Control Message Protocol (icmp)
• Internet Group Management Protocol (igmp)
• any Interior Protocol (ip)
• IP in IP tunneling (ipinip)
• KA9Q NOS-compatible IP over IP tunneling (nos)
• Open Shortest Path First routing (ospf)
• Payload Compression Protocol (pcp)
• Protocol Independent Multicast (pim)
• Transmission Control Protocol (tcp)