Manuals / Cisco Systems / Computer Equipment / Switch

Cisco Systems OL-5650-02 manual Removing an ACL from Circuits or DNS Queries

Models: OL-5650-02

1 122

Download 122 pages 20.34 Kb

Page 52

Chapter 1 Controlling CSS Access

Controlling CSS Network Traffic Through Access Control Lists

However, if you configure a CSS with the dns-servercommand, and the CSS receives a DNS query for a domain name that you configured on the CSS using the host command, the DNS query does not match an ACL that is configured with the apply dns command.

After you apply an ACL and ACLs are disabled on the CSS, you must enter the global configuration acl enable command to enable the ACLs on the CSS. For information on the acl enable command, see the “Enabling ACLs on the CSS” section later in this chapter.

Removing an ACL from Circuits or DNS Queries

Remove an ACL from the circuit when you need to delete a clause from an ACL, the ACL applied to the circuit, or an ACL from DNS queries. To remove an ACL from all circuits, an individual circuit, or DNS queries, use the remove command. The syntax and options for this ACL mode command are:

•remove all - Removes the ACL from all circuits.

(config-acl[7])# remove all

•remove circuit (circuit_name) - Removes the ACL from a specific circuit. For example, enter:

(config-acl[7])#remove circuit-(VLAN1)

To display a list of circuits that you can remove, use the remove ? command.

•remove dns - Removes the ACL from DNS queries. For example, enter:

(config-acl[7])# remove dns

We recommend that you globally disable ACLs on the CSS before removing an ACL from a circuit. If you remove an ACL from a circuit when ACLs are enabled on the CSS, the CSS applies an implicit “deny all” clause to this circuit causing the CSS to deny all traffic on it. If you do not want to deny traffic on the circuit, you must disable all ACLs on the CSS and then remove ACL from the circuit. By disabling all ACLs on the CSS, the CSS permits all traffic on all circuits.

For example:

1.In global configuration mode, disable all ACLs on the CSS.

(config)# acl disable

	Cisco Content Services Switch Security Configuration Guide
1-28	OL-5650-02

Image 52

Cisco Systems OL-5650-02 manual Removing an ACL from Circuits or DNS Queries, Config-acl7#remove circuit-VLAN1

Contents

Cisco Content Services Switch Security Configuration Guide Cisco Content Services Switch Security Configuration Guide N T E N T S IiiACL Overview Configuring the CSS as a Client of a Radius Server Configuring Firewall Load Balancing Example of Fwlb ViiViii B L E S OL-5650-02 Preface Audience How to Use This GuideXii Related Documentation XiiiRmon XivDocument Title Description Symbols and Conventions XviCisco.com Obtaining DocumentationXvii Documentation Feedback Documentation DVDOrdering Documentation XviiiCisco Product Security Overview Reporting Security Problems in Cisco ProductsXix Obtaining Technical Assistance Cisco Technical Support WebsiteSubmitting a Service Request XxiDefinitions of Service Request Severity XxiiXxiii Xxiv Controlling CSS Access Changing the Administrative Username and Password Config# username-offdm bobo password secretCreating Usernames and Passwords Config# username picard password captain superuserControlling CSS Access Creating Usernames and Passwords Config# no username picard Config# username picard password captain superuser NwbnnnrConfig# username picard password flute superuser Controlling Remote User Access to the CSS Configuring Virtual Authentication #config virtual authentication primary tacacs Configuring Console Authentication#config virtual authentication secondary local #config console authentication secondary local #config console authentication primary tacacs#config no console authentication Controlling Administrative Access to the CSS Enabling Administrative Access to the CSSDisabling Administrative Access to the CSS Config# no restrict web-mgmtControlling CSS Network Traffic Through Access Control Lists Config# restrict telnetACL Overview ACL ACL Configuration Quick Start Config-acl7#clause 15 permit any any destination any Config-acl7#clause 10 deny any any destination range 20Config-acl7#apply circuit-VLAN1 Creating an ACL Config-acl7#remove circuit-VLAN1 Config# acl disableDeleting an ACL Configuring Clauses Cisco Content Services Switch Security Configuration Guide Variables Options Parameters Destination content ownername/ rulename for an Variables OptionsParameters Variables Options Parameters Show group ?Adding a Clause When ACLs are Globally Enabled PreferConfig-acl7apply circuit-VLAN1 Config-acl7remove circuit-VLAN1Deleting a Clause Applying an ACL to a Circuit or DNS Queries Removing an ACL from Circuits or DNS Queries Enabling ACLs on the CSS Disabling ACLs on the CSS Showing ACLsField Description Setting the Show ACL Counters to Zero Logging ACL ActivityConfig-acl7#clause 1 log enable Config-acl7#clause 1 log disableConfig# no logging subsystem acl ACL ExampleConfiguring Network Qualifier Lists for ACLs Describing an NQL Creating an NQLAdding Networks to an NQL Config# logging subsystem nql level debug-7 Config-nqlbypassnql#no ip address 192.168.0.0/16Showing NQL Configurations Adding an NQL to an ACL ClauseConfiguring the Secure Shell Daemon Protocol Enabling SSH # licenseConfiguring SSH Access Configuring Sshd in the CSSConfiguring Sshd Keepalive Config# no restrict sshConfiguring Sshd Port Configuring Sshd Server-KeybitsConfiguring Sshd Version Config# sshd server-keybitsConfig# no sshd server-keybits Config# sshd versionConfiguring Telnet Access When Using Sshd Showing Sshd ConfigurationsConfig# no restrict telnet # show sshd config# show sshd sessions Ptyfd # show sshd versionRadius Server Configuring the CSS as a Client of a Radius Server Config# radius-server primary 172.27.56.76 secret Hello Radius Configuration Quick StartConfig# radius-server secondary 172.27.56.79 secret Hello Configuring a Radius Server for Use with the CSS #config virtual authentication primary radiusConfiguring Authentication Settings Configuring Authorization SettingsSpecifying a Primary Radius Server Config# no radius-server secondary Config# no radius-server primarySpecifying a Secondary Radius Server Configuring the Radius Server Timeouts Configuring the Radius Server RetransmitsConfig# radius-server timeout Config# no radius-server timeoutConfiguring the Radius Server Dead-Time Config# no radius-server retransmitConfig# radius-server dead-time Config# no radius-server dead-timeConfig# show radius statistics secondary DOWN, Unknown3describes the fields in the show radius statistics output OL-5650-02 TACACS+ Server TACACS+ Configuration Quick Start Config# show tacacs-server Configuring Authorization Settings Configuring Global TACACS+ Attributes #config tacacs-server timeout Setting the Global CSS TACACS+ Timeout Period#config no tacacs-server timeout Setting the Global TACACS+ Keepalive Frequency #config tacacs-server key market#config tacacs-server key acskefterefesdtx #config no tacacs-server keyConfig# no tacacs-server frequency Defining a TACACS+ ServerOL-5650-02 #config no tacacs-server 192.168.11.1 Setting TACACS+ Authorization #config tacacs-server authorize config #config tacacs-server authorize non-config#config no tacacs-server authorize config #config no tacacs-server authorize non-configSetting TACACS+ Accounting Showing TACACS+ Server Configuration Information Field Description OL-5650-02 Configuring Firewall Load Balancing Overview of Fwlb Configuring Fwlb Firewall SynchronizationConfig# ip firewall 1 192.168.27.1 192.168.28.1 Configuring a Keepalive Timeout for a FirewallConfig# no ip firewall Config# ip firewall timeout Configuring an IP Static Route for a FirewallConfig# no ip firewall timeout Configuring Ospf to Advertise Firewall Routes Config# ip route 192.168.2.0/24 firewall 1Config# no ip route 192.168.2.0/24 firewall Config# ospf redistribute firewall metric 3 type1Configuring RIP to Advertise Firewall Routes Example of Fwlb Static Route ConfigurationConfig# no ospf redistribute firewall Config# rip redistribute firewallConfig# ip firewall 1 192.168.28.1 192.168.27.1 Config# ip route 192.168.2.0/24 firewallConfig# ip firewall 2 192.168.28.2 192.168.27.2 Config# ip route 0.0.0.0/0 firewallExample of Fwlb Configuring Fwlb with VIP and Virtual Interface Redundancy Fwlb with VIP/Interface Redundancy Configuration Cisco Content Services Switch Security Configuration Guide Example of Firewall and Route Configurations CSS-OUT-L ConfigurationCSS-IN-L Configuration Config# show flows Config# show flows 192.165.22.1Displaying Firewall Flow Summaries Config# show ip routes firewall Displaying Firewall IP RoutesConfig# show ip firewall Displaying Firewall IP InformationOL-5650-02 D E IN-1IN-2 FTP IN-3Radius IN-4XML IN-5IN-6