IPv4 Access Control Lists (ACLs)

Introduction

Introduction

An Access Control List (ACL) is a list of one or more Access Control Entries (ACEs) specifying the criteria the switch uses to either permit (forward) or deny (drop) IP packets traversing the switch’s interfaces. This chapter describes how to configure, apply, and edit IPv4 ACLs in a network populated with the switches covered by this guide, and how to monitor IPv4 ACL actions.

Note

This chapter describes ACLs for IPv4 configuration and operation. In this

 

chapter, unless otherwise noted:

 

■ The term “ACL” refers to IPv4 ACLs.

 

■ Descriptions of ACL operation apply only to IPv4 ACLs.

 

For information on dynamic (RADIUS-assigned) ACLs, refer to “Dynamic Port

 

ACLs” on page 9-6.

 

.

 

Feature

Default

CLI

Standard ACLs

None

9-44

Extended ACLs

None

9-53

Enable or Disable an ACL

n/a

9-73

Display ACL Data

n/a

9-85

Delete an ACL

n/a

9-74

Configure an ACL from a TFTP Server

n/a

9-94

Enable ACL Logging

n/a

9-98

 

 

 

IPv4 filtering with ACLs can help improve network performance and restrict network use by creating policies for:

■Switch Management Access: Permits or denies in-band manage­ ment access. This includes limiting and/or preventing the use of designated protocols that run on top of IPv4, such as TCP, UDP, IGMP, ICMP, and others. Also included are the use of precedence and ToS criteria, and control for application transactions based on source and destination IPv4 addresses and transport layer port numbers.

■Application Access Security: Eliminates unwanted traffic in a path by filtering IPv4 packets where they enter or leave the switch on specific interfaces.

IPv4 ACLs can filter traffic to or from a host, a group of hosts, or entire subnets.

9-4