access-list (extended)
SecureStack C2 Configuration Guide 23-77
Ifsource2isnotspecifiedwithmove,onlyoneentrywillbemoved.
Mode
Globalconfiguration:C2(su)‐>router(Config)#
Usage
ValidaccesslistnumbersforstandardACLsare1to99.ForextendedACLs,validvaluesare100
to199.
Accesslistsareappliedtointerfacesbyusingthe
ipaccess‐groupcommand((page23‐79)).
Examples
Thisexampleshowshowtocreateaccesslist1withthreeentriesthatallowaccesstoonlythose
hostsonthethreespecifiednetworks.Thewildcardbitsapplytothehostportionsofthenetwork
addresses.Anyhostwithasourceaddressthatdoesnotmatchtheaccesslistentrieswill
be
rejected:
C2(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
C2(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255
C2(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255
Thisexamplemovesentry16tothebeginningofACL22:
C2(su)->router(Config)#access-list 22 move 1 16
access-list (extended)
UsethiscommandtodefineanextendedIPaccesslistbynumberwhenoperatinginroutermode.
Thenoformofthiscommandremovesthedefinedaccesslistorentry:
Syntax
To apply ACL restrictions to IP, UDP, ICMP or TCP packets:
access-list access-list-number {deny | permit} protocol source [source-wildcard]
[operator [port]] destination [destination-wildcard]
no access-list access-list-number [entry]
To insert or replace an ACL entry:
access-list access-list-number insert | replace entry
To move entries within an ACL:
access-list access-list-number move destination source1 [source2]
Parameters
Note: ACLs are not supported on routed VLANs which incorporate LAG ports.
access‐list‐number Specif iesanextendedaccesslistnumber.Validvaluesarefrom100to199.
deny|permit Deniesorpermitsaccessifspecif iedconditionsaremet.
To Next Page
Loading...
Need help?
General