Foundry Configuration Guide for the FESX, FSX, and FWSX
12 - 12 © Foundry Networks, Inc. December 2005
The traffic-policy option enables the device to rate limit inbound traffic and to count the packets and bytes per
packet to which ACL permit or deny clauses are applied. For configuration procedures and examples, see the
chapter “Traffic Policies” on page 15-1.
Configuration Examples for Extended Numbered ACLs
To configure an extended access list that blocks all Telnet traffic received on port 1/1 from IP host 209.157.22.26,
enter the following commands.
Here is another example of commands for configuring an extended ACL and applying it to an interface. These
examples show many of the syntax choices. Notice that some of the entries are configured to generate log entries
while other entries are not thus configured.
The first entry permits ICMP traffic from hosts in the 209.157.22.x network to hosts in the 209.157.21.x network.
The second entry denies IGMP traffic from the host device named “rkwong” to the 209.157.21.x network.
The third entry denies IGRP traffic from the 209.157.21.x network to the host device named “rkwong”.
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates Syslog entries
for packets that are denied by this entry.
The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL
would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.
The following commands apply ACL 102 to the incoming traffic on port 1/2 and to the incoming traffic on port 4/3.
FESX424 Router(config)# access-list 101 deny tcp host 209.157.22.26 any eq telnet
log
FESX424 Router(config)# access-list 101 permit ip any any
FESX424 Router(config)# int eth 1
FESX424 Router(config-if-e1000-1)# ip access-group 101 in
FESX424 Router(config)# write memory
FESX424 Router(config)# access-list 102 perm icmp 209.157.22.0/24 209.157.21.0/24
FESX424 Router(config)# access-list 102 deny igmp host rkwong 209.157.21.0/24 log
FESX424 Router(config)# access-list 102 deny igrp 209.157.21.0/24 host rkwong log
FESX424 Router(config)# access-list 102 deny ip host 209.157.21.100 host
209.157.22.1 log
FESX424 Router(config)# access-list 102 deny ospf any any log
FESX424 Router(config)# access-list 102 permit ip any any
FastIron SuperX Router(config)# int eth 1/2
FastIron SuperX Router(config-if-1/2)# ip access-group 102 in
FastIron SuperX Router(config-if-1/2)# exit
FastIron SuperX Router(config)# int eth 4/3
FastIron SuperX Router(config-if-4/3)# ip access-group 102 in
FastIron SuperX Router(config)# write memory
To Next Page
Loading...
Need help?
General
