Cisco Systems RJ-45-to-AUX manual Applying Access Lists Using access−class, 266

CoriolisRSM1(config)#access−list 199 permit ip any ?

A.B.C.D	Destination address
any	Any destination host
host	A single destination host

8. Just as in Step 7, we need to identify the destination addresses to permit:

CoriolisRSM1(config)#access−list 199 permit ip any any

CoriolisRSM1(config)#

You’re not quite done yet. Even though you just created an access list, it still has to be applied to an interface before it will function.

Applying Access Lists Using access−class

Let’s create an access list that allows Telnet access to the switch from the IP address 192.151.52.19 (this is the IP address of the only PC that will be used to Telnet into your switch). To do this, use the following command:

CAT5KRSM(config)# access−list 5 permit 192.151.52.19

Next, you need to enter Line Configuration mode for all five VTY lines with the following command:

CAT5KRSM (config)# line vty 0 4

CAT5KRSM (config−line)#

Finally, use the access−class command to apply the access list to an inbound interface with the following command:

CAT5KRSM(config−line)# access−class 5 in

Applying Access Lists Using distribute−list

To apply an access list using the distribute−list command, you need to have created a standard access list. Once your access list is configured, you can apply it to an inbound or outbound interface. Here is the syntax when using the distribute−list command to apply an access list to an outbound interface:

distribute−list {access−list numbername} out

[interface namerouting processautonomous system number]

Let’s say you have an access list that will allow network traffic from network 192.1.1.0 but denies traffic from interface 192.2.1.0. Do not forget that an implied “deny all” is attached to the access list:

access−list 1 permit 192.1.1.0 0.0.0.255

To use a distribution−list command you must also specify a routing protocol to use. In this case we will use OSPF:

router ospf 1

To apply the access list using the distribute−list command, you must attach the access list to the outbound interface you wish to filter. Let’s say for this example it is Fast Ethernet port 0/0. Here is what you command might look like:

distribute−list 1 out fastethernet0/0

266