Foundry Networks FESX User Manual

Foundry Configuration Guide for the FESX, FSX, and FWSX
12 - 8 © Foundry Networks, Inc. December 2005
Configuration Example for Standard Named ACLs
To configure a standard named ACL, enter commands such as the following.
The commands in this example configure a standard ACL named “Net1”. The entries in this ACL deny packets
from three source IP addresses from being forwarded on port 1. Since the implicit action for an ACL is “deny”, the
last ACL entry in this ACL permits all packets that are not explicitly denied by the first three ACL entries. For an
example of how to configure the same entries in a numbered ACL, see “Configuring Standard Numbered ACLs”
on page 12-4.
Notice that the command prompt changes after you enter the ACL type and name. The “std” in the command
prompt indicates that you are configuring entries for a standard ACL. For an extended ACL, this part of the
command prompt is “ext“. The “nacl” indicates that you are configuring a named ACL.
Configuring Extended Numbered ACLs
This section describes how to configure extended numbered ACLs.
Extended ACLs let you permit or deny packets based on the following information:
• IP protocol
• Source IP address or host name
• Destination IP address or host name
• Source TCP or UDP port (if the IP protocol is TCP or UDP)
• Destination TCP or UDP port (if the IP protocol is TCP or UDP)
The IP protocol can be one of the following well-known names or any IP protocol number from 0 – 255:
• Internet Control Message Protocol (ICMP)
• Internet Group Management Protocol (IGMP)
• Internet Gateway Routing Protocol (IGRP)
• Internet Protocol (IP)
• Open Shortest Path First (OSPF)
• Transmission Control Protocol (TCP)
• User Datagram Protocol (UDP)
For TCP and UDP, you also can specify a comparison operator and port name or number. For example, you can
configure a policy to block web access to a specific website by denying all TCP port 80 (HTTP) packets from a
specified source IP address to the website’s IP address.
Extended Numbered ACL Syntax
[no] access-list <acl-num> deny | permit <ip-protocol> <source-ip> | <hostname> <wildcard> [<operator>
<source-tcp/udp-port>] <destination-ip> | <hostname> [<icmp-num> | <icmp-type>] <wildcard> [<tcp/udp
comparison operator> <destination-tcp/udp-port>] [dscp-cos-mapping ] [dscp-marking <0-63> [802.1p-priority-
FESX424 Router(config)# ip access-list standard Net1
FESX424 Router(config-std-nacl)# deny host 209.157.22.26 log
FESX424 Router(config-std-nacl)# deny 209.157.29.12 log
FESX424 Router(config-std-nacl)# deny host IPHost1 log
FESX424 Router(config-std-nacl)# permit any
FESX424 Router(config-std-nacl)# exit
FESX424 Router(config)# int eth 1
FESX424 Router(config-if-e1000-1)# ip access-group Net1 in

Foundry Networks FESX Specifications

General

Brand	Foundry Networks
Model	FESX
Category	Switch
Language	English