IPv4 Access Control Lists (ACLs)

Configuring and Assigning an IPv4 ACL

For example, suppose that you have applied the ACL shown in figure 9-10to inbound IPv4 traffic on VLAN 1 (the default VLAN):

Source Address

Mask

DestinationAddress

Mask

ip access-list extended "Sample-List "

10deny ip 10.28.235.10 0.0.0.0 0.0.0.0 255.255.255.255

20deny ip 10.28.245.89 0.0.0.0 0.0.0.0 255.255.255.255

30permit tcp 10.28.18.100 0.0.0.0 10.28.237.1 0.0.0.0

40deny tcp 10.28.18.100 0.0.0.0 0.0.0.0 255.255.255.255

50 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

(Implicit Deny)

 

After the last explicit ACE there is always an Implicit Deny. However, in this case it will not be used because

 

exit

the last, permit ip ACL allows all IPv4 packets that earlier ACEs have not already permitted or denied.

 

Figure 9-10. Example of a Standard ACL that Permits All IPv4 Traffic Not Implicitly Denied

Table 9-4. Effect of the Above ACL on Inbound IPv4 Traffic in the Assigned VLAN

Line # Action

n/a Shows type (extended) and ID (Sample-List-2).

10A packet from SA 10.28.235.10 will be denied (dropped). This ACE filters out all packets received from 10.28.235.10. As a result, IPv4 traffic from that device will not be allowed and packets from that device will not be compared against any later entries in the list.

20A packet from SA 10.28.245.89 will be denied (dropped). This ACE filters out all packets received from 10.28.245.89. As the result, IPv4 traffic from that device will not be allowed and packets from that device will not be compared against any later entries in the list.

30A TCP packet from SA 10.28.18.100 with a DA of 10.28.237.1 will be permitted (forwarded). Since no earlier ACEs in the list have filtered TCP packets from 10.28.18.100 and destined for 10.28.237.1, the switch will use this ACE to evaluate such packets. Any packets that meet this criteria will be forwarded. (Any packets that do not meet this TCP source-destination criteria are not affected by this ACE.)

40A TCP packet from source address 10.28.18.100 to any destination address will be denied (dropped). Since, in this example, the intent is to block TCP traffic from 10.28.18.100 to any destination except the destination stated in the ACE at line 30, this ACE must follow the ACE at line 30. (If their relative positions were exchanged, all TCP traffic from 10.28.18.100 would be dropped, including the traffic for the 10.28.18.1 destination.)

9-40