22-9
Cisco Systems IntelligentGigabit Ethernet Switch Modules for the IBM BladeCenter, Software Configuration Guide
24R9746
Chapter22 Configuring Network Securi ty with ACLs
Configuring ACLs
Use the no access-list access-list-number global configuration command to delete the entire ACL. You
cannot delete individual ACEs from numbered access lists.
Note When creating an ACL, remember that, by default, the end of the ACL contains an implicit deny
statement for all packets that it did not find a match for before reaching the end. With standard access
lists, if you omit the mask from an associated IP host address ACL specification, 0.0.0.0 is assumed to
be the mask.
This example shows how to create a standard ACL to deny access to IP host 171.69.198.102, permit
access to any others, and display the results.
Switch (config)# access-list 2 deny host 171.69.198.102
Switch (config)# access-list 2 permit any
Switch(config)# end
Switch# show access-lists
Standard IP access list 2
deny 171.69.198.102
permit any
Creating a Numbered Extended ACL
Although standard ACLs use only source addresses for matching, you can use an exte nded ACL source
and destination addresses for matching operations and optional protocol type informat ion for finer
granularity of control. Some protocols also have specific parameters and keywords that apply to that
protocol.
These IP protocols are supported on physical interfaces (protocol keywords are in parentheses in bold):
Internet Protocol (ip), Transmission Control Protocol (tcp), or User Datagram Protoc ol (udp).
Supported parameters can be grouped into these categories:
•TCP
•UDP
Table22-3 lists the possible filtering parameters for ACEs for each protocol type.
Step4 show access-lists [number | name] Show the access list configuration.
Step5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Table22-3 Filtering Parameter ACEs Supported by Different IP Protocols
Filtering Parameter1TCP UDP
Layer 3 Parameters:
IP type of service (ToS) byte2––
Differentiated Services Code Point (DSCP) X X
IP source address X X
IP destination address X X
Fragments – –
TCP or UDP X X