12-10
ATM Switch Router Software Configuration Guide
OL-7396-01
Chapter12 Using Access Control
Filtering IP Packets at the IP Interfaces
•Extended IP access lists use source and destination addresses for matching operation s, as well as
optional protocol type information for increased control.
•Dynamic extended IP access lists grant access per user to a specific source or destination host
through a user authentication process. In essence, you can allow user access through a firewall
dynamically, without compromising security restrictions.
To create a standard access list, use one of the following commands in glob al configuration mode:
To create an extended access list, use one of the following commands in global configuration mode:
After you create an access list, any subsequent additions (possibly entered from the terminal) are placed
at the end of the list. In other words, you cannot selectively add or remove access list command lines
from a specific access list.
Note When making the standard and extended access list, by default, the end of the access list contains an
implicit deny statement for everything if it does not find a match before reaching the end. Furth er, with
standard access lists, if you omit the mask from an associated IP host address access list specification,
0.0.0.0 is assumed to be the mask.
Command Purpose
access-list access-list-number {deny | permit}
source [source-wildcard]
Defines a standard IP access list using a source
address and wildcard.
access-list access-list-number {deny | permit}
any
Defines a standard IP access list using an
abbreviation for the source and source mask of
0.0.0.0 255.255.255.255.
Command Purpose
access-list access-list-number {deny | permit}
protocol source source-wildcard destination
destination-wildcard [precedence precedence]
[tos tos] [established] [log]
Defines an extended IP access list number and the
access conditions. Use the log keyword to get
access list logging messages, including
violations.
access-list access-list-number {deny | permit}
protocol any
Defines an extended IP access list using an
abbreviation for a source and source wildcard of
0.0.0.0 255.255.255.255, and an abbreviation for
a destination and destination wildcard of 0.0.0.0
255.255.255.255.
access-list access-list-number {deny | permit}
protocol host source host destination
Defines an extended IP access list using an
abbreviation for a source and source wildcard of
source 0.0.0.0, and an abbreviation for a
destination and destination wildcard of
destination 0.0.0.0.
access-list access-list-number dynamic
dynamic-name [timeout minutes] {deny | permit}
protocol source source-wildcard destination
destination-wildcard [precedence precedence]
[tos tos] [established] [log]
Defines a dynamic access list.