Configuration Guide Configuring ACL
sw1(config-exp-nacl)#pemit any any any any
sw1(config-exp-nacl)#exit
sw1(config)#int gigabitEthernet 0/2
sw1(config-if-GigabitEthernet 0/2)#expert access-group 2700 in
On a visitor's PC, ping the financial data server. Verify that the ping operation fails.
On a visitor's PC, ping the public resource server. Verify that the ping operation succeeds.
On a visitor's PC, ping the gateway address 192.168.1.1 of an employee. Verify that the ping operation
fails.
On a visitor's PC, access the Internet, for example, visit the Baidu website. Verify that the webpage can
be opened.
sw1(config)#show access-lists
expert access-list extended 2700
10 deny ip any any 192.168.1.0 0.0.0.255 any
20 deny ip any any host 10.1.1.1 any
30 permit ip any any any any
sw1(config)#show access-group
expert access-group 2700 in
Applied On interface GigabitEthernet 0/2
11.4.4 Configuring an IPv6 Extended ACL
Configuration Effect
Configure and apply an IPv6 ACL to an interface to control all incoming and outgoing IPv5 packets of this interface. You can
permit or deny the entry of specific IPv6 packets to a network to control access of IPv6 users to network resources.
Configuration Steps
Configuring an IPv6 ACL
(Mandatory) Configure an IP ACL if you want to access of IPv4 users to network resources.
You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The IPv6
ACL takes effect only on the local device, and does not affect other devices on the network.
Adding ACEs to an IPv6 ACL
(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, all incoming IPv6 packets of the device
are denied by default.
Applying an IPv6 ACL
(Mandatory) Apply an IPv6 ACL to a specified interface on a device if you want this ACL take effect.
To Next Page
Loading...
Need help?
General
