IPv4 Access Control Lists (ACLs)

Configuring and Assigning an IPv4 ACL

3.One or more deny/permit list entries (ACEs): One entry per line.

Element

Notes

 

 

Type

Standard or Extended

 

 

Identifier

• Alphanumeric; Up to 64 Characters, Including

 

Spaces

 

• Numeric: 1 - 99 (Standard) or 100 - 199 (Extended)

 

 

Remark

Allows up to 100 alphanumeric characters, including

 

blank spaces. (If any spaces are used, the remark

 

must be enclosed in a pair of single or double

 

quotes.) A remark is associated with a particular ACE

 

and will have the same sequence number as the ACE.

 

(One remark is allowed per ACE.) Refer to “Attaching

 

a Remark to an ACE” on page 9-81.

 

 

Maximum ACEs Per per Switch

The upper limit on ACEs supported by the switch

 

depends on the concurrent resource usage by

 

configured ACL, QoS, IDM, Mirroring, and other

 

features. Refer to “Monitoring Shared Resources”

 

on page 9-100.

 

 

4.Implicit Deny: Where an ACL is in use, it denies any packets that do not have a match with the ACEs explicitly configured in the list. The Implicit Deny does not appear in ACL configuration listings, but always functions when the switch uses an ACL to filter packets. (You cannot delete the Implicit Deny, but you can supersede it with a permit any or permit ip any any statement.)

Standard ACL Structure

Individual ACEs in a standard ACL include only a permit/deny statement, the source addressing, and an optional log command (available with “deny” statements).

ip access-list standard < identifier >" [ [ seq-#] remark < remark-str>]

<permit deny > < SA > [log]

.

.

.

<Implicit Deny >

exit

Note: The optional log function isavailable only for explicit “deny” ACEs.

Figure 9-6. Example of the General Structure for a Standard ACL

9-36