Cisco Systems IE 2000 Resequencing ACEs in an ACL, Named Standard and Extended ACLs

37-7
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 37 Configuring Network Security with ACLs
Information About Network Security with ACLs
• User Datagram Protocol (udp)
Note ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered.
Note The switch does not support dynamic or reflexive access lists. It also does not sup port filtering based on
the type of service (ToS) minimize-monetary-cost bit.
Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP.
After an ACL is created, any additions (possibly entered from the terminal) are placed at the end of the
list. You cannot selectively add or remove access list entries from a numbered access list.
Note When you are creating an ACL, remember that, by default, the end of the access list contains an implicit
deny statement for all packets if it did not find a match before reaching the end.
After creating a numbered extended ACL, you can apply it to terminal lines (see the “Applying an IPv4
ACL to a Terminal Line” section on page 37-17), to interfaces (see the “Applying an IPv4 ACL to an
Interface” section on page 37-17), or to VLANs (see the “Monitoring and Maintaining Network Security
with ACLs” section on page 37-19).
Resequencing ACEs in an ACL
Sequence numbers for the entries in an access list are automatically generated when you create a new
ACL. You can use the ip access-list resequence global configuration command to edit the sequence
numbers in an ACL and change the order in which ACEs are applied. For example, if you add a new ACE
to an ACL, it is placed at the bottom of the list. By changing the sequence number, you can move the
ACE to a different position in the ACL.
Named Standard and Extended ACLs
You can identify IPv4 ACLs with an alphanumeric string (a name) rather than a number. You can use
named ACLs to configure more IPv4 access lists in a router than if you were to use numbered access
lists. If you identify your access list with a name rather than a number, the mode and command syntax
are slightly different. However, not all commands that use IP access lists accept a named access list.
Note The name you give to a standard or extended ACL can also be a number in the supported range of access
list numbers. That is, the name of a standard IP ACL can be 1 to 99; the name of an extended IP ACL
can be 100 to 199. The advantage of using named ACLs instead of numbered lists is that you can delete
individual entries from a named list.
Consider these guidelines and limitations before configuring named ACLs:
• Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and
route filters on interfaces can use a name.
• A standard ACL and an extended ACL cannot have the same name.
• Numbered ACLs are also available, as described in the “Creating a Numbered Standard ACL”
section on page 37-11.