access-list (standard)
18-72 Security Configuration
Parameters
Defaults
Ifinsert,replaceormovearenotspecified,thenewentrywillbeappendedtotheaccesslist.
Ifsource2isnotspecifiedwithmove,onlyoneentrywillbemoved.
Mode
Globalconfiguration:C2(su)‐>router(Config)#
Usage
ValidaccesslistnumbersforstandardACLsare1to99.ForextendedACLs,validvaluesare100
to199.
Accesslistsareappliedtointerfacesbyusingthe
ipaccess‐groupcommand(“ipaccess‐group”
onpage 18‐74).
Examples
Thisexampleshowshowtocreateaccess list1withthreeentriesthatallowaccesstoonlythose
hostsonthethreespecifiednetworks.Thewildcardbitsapplytothehostportionsofthenetwork
addresses.Anyhostwithasourceaddressthatdoesnotmatchtheaccesslistentrieswill
be
rejected:
C2(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
C2(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255
C2(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255
Thisexamplemovesentry16tothebeginningofACL22:
C2(su)->router(Config)#access-list 22 move 1 16
access‐list‐
number
Specifiesastandardaccesslistnumber.Validvaluesarefrom1to99.
deny|permit Deniesorpermitsaccessifspecifiedconditionsaremet.
source Specifiesthenetworkorhostfromwhichthepacketwillbesent.Valid
optionsforexpressingsourceare:
•IPaddressorrangeofaddresses
(A.B.C.D)
• any‐Anysourcehost
• hostsource‐IPaddressofasinglesourcehost
source‐wildcard (Optional)Specifiesthebitstoignoreinthesourceaddress.
insert|replace
entry
(Optional)InsertsthisnewentrybeforeaspecifiedentryinanexistingACL,
orreplacesaspecifiedentrywiththisnewentry.
move
destination
source1source2
(Optional)Movesasequenceofaccesslistentriesbeforeanotherentry.
Destinationisthenumberoftheexistingentrybeforewhichthisnewentry
willbemoved.Source1isasingleentrynumberorthefirstentrynumberin
therangetobemoved.Source2(optional)isthe
lastentrynumberinthe
rangetobemoved.Ifsource2isnotspecified,onlythesource1entrywillbe
moved.
To Next Page