IPv4 Access Control Lists (ACLs)

IPv4 Static ACL Operation

1.Permit inbound IPv4 traffic from IP address 10.11.11.42.

2.Deny only the inbound Telnet traffic from address 10.11.11.101.

3.Permit only inbound Telnet traffic from IP address 10.11.11.33.

4.Deny all other inbound IPv4 traffic.

The following ACL model , when assigned to inbound filtering on an interface, supports the above case:

ip access-list extended "Test-02"

110 permit ip 10.11.11.42 0.0.0.0 0.0.0.0 255.255.255.255

220 deny tcp 10.11.11.101 0.0.0.0 0.0.0.0 255.255.255.255 eq 23

330 permit ip 10.11.11.101 0.0.0.0 0.0.0.0 255.255.255.255

440 permit tcp 10.11.11.33 0.0.0.0 0.0.0.0 255.255.255.255 eq 23

5< Implicit Deny >

exit

1.Permits IPv4 traffic from source address 10.11.11.42. Packets matching this criterion are permitted and will not be compared to any later ACE in the list. IPv4 packets not matching this criterion will be compared to the next entry in the list.

2.Denies Telnet traffic from source address 10.11.11.101. Packets matching this criterion are dropped and are not compared to later criteria in the list. Packets not matching this criterion are compared to the next entry in the list.

3.Permits IPv4 traffic from source address 10.11.11.101. Any packets matching this criterion will be permitted and will not be compared to any later criteria in the list. Because this entry comes after the entry blocking Telnet traffic from this same address, there will not be any Telnet packets to compare with this entry; they have already been dropped as a result of matching the preceding entry.

4.Permits Telnet traffic from source address 10.11.11.33. Packets matching this criterion are permitted and are not compared to any later criteria in the list. Packets not matching this criterion are compared to the next entry in the list.

5.This entry does not appear in an actual ACL, but is implicit as the last entry in every ACL. Any IPv4 packets that do not match any of the criteria in the ACL’s preceding entries will be denied (dropped).

Figure 9-4. Example of How an ACL Filters Packets

It is important to remember that all IPv4 ACLs configurable on the switch include an implicit deny ip any. That is, IPv4 packets that the ACL does not explicitly permit or deny will be implicitly denied, and therefore dropped instead of forwarded on the interface. If you want to preempt the implicit deny so that IPv4 packets not explicitly denied by other ACEs in the ACL will be permitted, insert an explicit “permit any” as the last ACE in the ACL. Doing so permits any packet not explicitly denied by earlier entries.

9-23