15-49
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Configuring VACLs
Note Because the VACLs have an implicit deny feature at the end of the list, all other traffic is denied.
This example shows how to create an ACE for IPACL1 to allow the traffic from all source addresses:
Console> (enable) set security acl ip IPACL1 permit any
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL1 to block the traffic from source address 171.3.8.2:
Console> (enable) set security acl ip IPACL1 deny host 171.3.8.2
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable) show security acl info IPACL1 editbuffer
set security acl ip IPACL1
-----------------------------------------------------------------
1. permit ip host 172.20.53.4 any
2. permit ip any any
3. deny ip host 171.3.8.2 any
Console> (enable)
This example shows how to commit the ACEs to NVRAM:
Console> (enable) commit security acl all
ACL commit in progress.
ACL IPACL1 is committed to hardware.
Console> (enable)
Note For more information about the commit security acl all command, see the “Committing ACLs” section
on page 15-53.
Enter the show security acl info IPACL1 command to verify that the changes were committed. If this
VACL has not been mapped to a VLAN, enter the set security acl map command to map it to a VLAN.
This example shows how to create an ACE for IPACL2 to block the traffic from source address
172.20.3.2 and place this ACE before ACE number 2 in the VACL. Optionally, you can enter the modify
keyword to replace an existing ACE with a new ACE. Enter the show security acl info acl_name
[editbuffer] command to see the current ACE listing that is stored in NVRAM (enter the editbuffer
keyword to see edit buffer contents).
Console> (enable) set security acl ip IPACL2 deny host 172.20.3.2 before 2
IPACL2 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL2 to redirect IP traffic to port 3/1 from source
address 1.2.3.4 with the destination address of 255.255.255.255. The host can be used as an abbreviation
for a source and source-wildcard of 0.0.0.0. This ACE also specifies the following:
• precedence—IP precedence values that range between zero for low priority and seven for high
priority.
• tos—Type of service levels that range between 0 and 15.
Note The ToS values are bits 3 through 6 of the IP ToS byte as defined by RFC 1349. The precedence values are
bits 0 through 2 as defined by RFC 791.
To Next Page
Loading...
Need help?
General