Cisco Catalyst 3750-E User Manual

35-26
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 35 Configuring Network Security with ACLs
Configuring IPv4 ACLs
Named ACLs
This example creates a standard ACL named internet_filter and an extended ACL named
marketing_group. The internet_filter ACL allows all traffic from the source address 1.2.3.4.
Switch(config)# ip access-list standard Internet_filter
Switch(config-ext-nacl)# permit 1.2.3.4
Switch(config-ext-nacl)# exit
The marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard
171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits ICMP traffic, denies UDP traffic
from any source to the destination address range 171.69.0.0 through 179.69.255.255 with a destination
port less than 1024, denies any other IP traffic, and provides a log of the result.
Switch(config)# ip access-list extended marketing_group
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 e
q telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit icmp any any
Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt
1024
Switch(config-ext-nacl)# deny ip any any log
Switch(config-ext-nacl)# exit
The Internet_filter ACL is applied to outgoing traffic and the marketing_group ACL is applied to
incoming traffic on a Layer 3 port.
Switch(config)# interface gigabitethernet3/0/2
Switch(config-if)# no switchport
Switch(config-if)# ip address 2.0.5.1 255.255.255.0
Switch(config-if)# ip access-group Internet_filter out
Switch(config-if)# ip access-group marketing_group in
Time Range Applied to an IP ACL
This example denies HTTP traffic on IP on Monday through Friday between the hours of 8:00 a.m. and
6:00 p.m (18:00). The example allows UDP traffic only on Saturday and Sunday from noon to 8:00 p.m.
(20:00).
Switch(config)# time-range no-http
Switch(config)# periodic weekdays 8:00 to 18:00
!
Switch(config)# time-range udp-yes
Switch(config)# periodic weekend 12:00 to 20:00
!
Switch(config)# ip access-list extended strict
Switch(config-ext-nacl)# deny tcp any any eq www time-range no-h
ttp
Switch(config-ext-nacl)# permit udp any any time-range udp-yes
!
Switch(config-ext-nacl)# exit
Switch(config)# interface gigabitethernet2/0/1
Switch(config-if)# ip access-group strict in
Commented IP ACL Entries
In this example of a numbered ACL, the workstation that belongs to Jones is allowed access, and the
workstation that belongs to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith workstat
ion through
Switch(config)# access-list 1 deny 171.69.3.13

Cisco Catalyst 3750-E Specifications

General

Series	Catalyst 3750-E
Switching Capacity	32 Gbps
Stacking Bandwidth	32 Gbps
StackWise Plus	Yes
Layer Support	Layer 3
MAC Address Table Size	12, 000 entries
RAM	256 MB
Flash Memory	64 MB
Memory	256 MB DRAM, 64 MB Flash
Operating Temperature	32 to 113°F (0 to 45°C)
Ports	48 10/100/1000 Ethernet ports
Form Factor	Rack-mountable
Jumbo Frame Support	Yes
Input Voltage	100 to 240 VAC
Storage Temperature	-25 to 70 °C
Relative Humidity	10 to 90% non-condensing